CVE-2026-48801
Description
linkify-it is a links recognition library with full Unicode support. Prior to 5.0.1, LinkifyIt.prototype.match, the package's primary public API, has O(N²) algorithmic complexity for inputs containing many fuzzy links or emails because the JavaScript-level scan loop re-slices input and re-runs unanchored regex searches on progressively shorter tails. Any service that synchronously renders untrusted Markdown with linkify:true on a request hot path can inherit a worker-process denial of service triggerable by a tens-of-KB request body. This issue is fixed in version 5.0.1.
How to fix
- markdown-it linkify-it5.0.1 or later
- linkify-it5.0.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| markdown-it linkify-it | v < 5.0.1 | 5.0.1 |
| linkify-itnpm | v < 5.0.1 | 5.0.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.