Skip to content
OpenAdvisories
High · 8.7 CVE-2026-48801 EUVD-2026-44454GHSA-22p9-wv53-3rq4

linkify-it: Quadratic algorithmic complexity in LinkifyIt#match scan loop

Published Jul 14, 2026 · Updated Jul 15, 2026 · Assigned by GitHub_M

Description

linkify-it is a links recognition library with full Unicode support. Prior to 5.0.1, LinkifyIt.prototype.match, the package's primary public API, has O(N²) algorithmic complexity for inputs containing many fuzzy links or emails because the JavaScript-level scan loop re-slices input and re-runs unanchored regex searches on progressively shorter tails. Any service that synchronously renders untrusted Markdown with linkify:true on a request hot path can inherit a worker-process denial of service triggerable by a tens-of-KB request body. This issue is fixed in version 5.0.1.

Affected products

VendorProductAffectedFixed
markdown-it linkify-it < 5.0.1 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Ubuntu 26.10 node-markdown-it No fix yet —
Ubuntu 26.04 LTS node-markdown-it No fix yet —
Ubuntu 24.04 LTS node-markdown-it No fix yet —
Ubuntu 22.04 LTS node-markdown-it No fix yet —
ReleasePackageFixed inAdvisory
RHEL 10 rh-podman-desktop 1.1.2-1.el10_2 RHSA-2026:57590
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Red Hat Hardened Images 1 rust +18 1.97.0-1.1.hum1 RHSA-2026:38187

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling opensearch-dashboards-3-dashboards-observability 3.7.0-r5 —

Affected packages

EcosystemPackageAffectedFixedRecord
npm linkify-it < 5.0.1 5.0.1 GHSA-22p9-wv53-3rq4

Advisories 6

References