Skip to content
OpenAdvisories

Product · markdown-it

linkify-it

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 8.7
    CVE-2026-48801

    linkify-it: Quadratic algorithmic complexity in LinkifyIt#match scan loop

    linkify-it is a links recognition library with full Unicode support. Prior to 5.0.1, LinkifyIt.prototype.match, the package's primary public API, has O(N²) algorithmic complexity for inputs containing many fuzzy links or emails because the JavaScript-level sc…

    markdown-it linkify-it node-markdown-it linkify-it Ubuntu npm
  • High 7.5
    CVE-2026-59887

    linkify-it: Quadratic-complexity DoS via the `mailto:` validator scan-loop on attacker text

    linkify-it is a links recognition library with full Unicode support. Prior to 5.0.2, the mailto: schema validator used by .test() and .match() can be invoked at every mailto: occurrence and scan the remaining input through src_email_name in lib/re.mjs, causin…

    markdown-it linkify-it linkify-it npm