CVE-2026-59887

Name of the Vulnerable Software and Affected Versions linkify-it versions prior to 5.0.2 Confluence Data Center versions 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.1.2, and 10.2.0

Description A Regular Expression Denial of Service (ReDoS) exists in the mailto: schema validator. When using the .test() or .match() functions, the validator is triggered at every occurrence of mailto:. The src email name variable in lib/re.mjs greedily scans the remaining input text, leading to quadratic O(n^2) CPU consumption. An unauthenticated attacker can exploit this by providing crafted user text, such as repeated mailto: strings, which can block the single-threaded event loop for several seconds and make the service unavailable.

Recommendations Update linkify-it to version 5.0.2. For Confluence Data Center 9.2, upgrade to a release greater than or equal to 9.2.23. For Confluence Data Center 10.2, upgrade to a release greater than or equal to 10.2.15.