CVE-2026-48801

HighCVSS 7.5

Published: 14/07/2026(UTC)Updated: 06/08/2026(UTC)Translated: 16/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.35%

28th percentile - higher than 28% of all known CVEs

Summary

The linkify-it library before version 5.0.1 has a quadratic algorithmic complexity vulnerability in the LinkifyIt.prototype.match function. For inputs containing many fuzzy links or emails, the scanning loop repeatedly re-slices input and re-runs regex searches on progressively shorter tails, causing excessive CPU usage.

Risk Assessment

Services that synchronously render untrusted Markdown with linkify:true on a request hot path can be easily overloaded by a tens-of-KB request body, causing worker-process denial of service and service disruption.

Recommendation

Immediately update the linkify-it library to version 5.0.1 or later. If an update is not possible, temporarily disable the linkify:true option in the Markdown parser or limit the size of processed input data.

Other vulnerabilities in linkify-it

CVE-2026-59887High
The linkify-it library before version 5.0.2 contains a ReDoS (Regular Expression Denial of Service) vulnerability. The mailto: schema validator used by .test() and .match() can be invoked at every mailto: occurrence and scan the remaining input through src_email_name in lib/re.mjs, causing O(n^2) CPU consumption on crafted user text.

Original NVD description (English source)

linkify-it is a links recognition library with full Unicode support. Prior to 5.0.1, LinkifyIt.prototype.match, the package's primary public API, has O(N²) algorithmic complexity for inputs containing many fuzzy links or emails because the JavaScript-level scan loop re-slices input and re-runs unanchored regex searches on progressively shorter tails. Any service that synchronously renders untrusted Markdown with linkify:true on a request hot path can inherit a worker-process denial of service triggerable by a tens-of-KB request body. This issue is fixed in version 5.0.1.