CVE-2026-48801: linkify-it: Quadratic algorithmic complexity in LinkifyIt#match scan loop

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-07-14 · updated 2026-10-24
Weakness: CWE-1333

Description

linkify-it is a links recognition library with full Unicode support. Prior to 5.0.1, LinkifyIt.prototype.match, the package's primary public API, has O(N²) algorithmic complexity for inputs containing many fuzzy links or emails because the JavaScript-level scan loop re-slices input and re-runs unanchored regex searches on progressively shorter tails. Any service that synchronously renders untrusted Markdown with linkify:true on a request hot path can inherit a worker-process denial of service triggerable by a tens-of-KB request body. This issue is fixed in version 5.0.1.

Affected products

markdown-it linkify-it: before 5.0.1 — fixed in 5.0.1

How to fix

Upgrade to a fixed version: markdown-it linkify-it 5.0.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-48801 or the next vulnerability affects your stack