CVE-2026-59887
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk47th percentile - higher than 47% of all known CVEs
Summary
The linkify-it library before version 5.0.2 contains a ReDoS (Regular Expression Denial of Service) vulnerability. The mailto: schema validator used by .test() and .match() can be invoked at every mailto: occurrence and scan the remaining input through src_email_name in lib/re.mjs, causing O(n^2) CPU consumption on crafted user text.
Risk Assessment
An attacker can send specially crafted text containing multiple mailto: occurrences, leading to excessive CPU consumption and potential server resource exhaustion, causing a denial of service (DoS).
Recommendation
Immediately update the linkify-it library to version 5.0.2 or later, which contains the fix for this vulnerability.
Other vulnerabilities in linkify-it
Original NVD description (English source)
linkify-it is a links recognition library with full Unicode support. Prior to 5.0.2, the mailto: schema validator used by .test() and .match() can be invoked at every mailto: occurrence and scan the remaining input through src_email_name in lib/re.mjs, causing O(n^2) CPU consumption on crafted user text. This issue is fixed in version 5.0.2.