CVE-2026-48801

Name of the Vulnerable Software and Affected Versions linkify-it versions prior to 5.0.1

Description LinkifyIt.prototype.match (the primary public API) contains a structural issue in its JavaScript-level scan loop that results in O(N²) algorithmic complexity when processing inputs with numerous fuzzy links or emails. This occurs because the loop re-slices the input and re-runs unanchored regex searches on progressively shorter tails. This behavior can lead to a worker-process denial of service (DoS) for services that synchronously render untrusted Markdown with linkify:true on a request hot path, where a request body of only a few tens of kilobytes can block a worker thread for several seconds.

Recommendations Update linkify-it to version 5.0.1.