Markdown It Linkify It vulnerabilities
2 vulnerabilities
Known vulnerabilities in Markdown It Linkify It, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
PrioritiseCVE-2026-48801markdown-it · linkify-it +37 morelinkify-it: Quadratic algorithmic complexity in LinkifyIt#match scan looplinkify-it is a links recognition library with full Unicode support. Prior to 5.0.1, LinkifyIt.prototype.match, the package's primary public API, has O(N²) algorithmic complexity for inputs containing many fuzzy links or emails because the JavaScript-level scan loop re-slices input and re-runs unanchored regex searches on progressively shorter tails. Any service that synchronously renders untrusted Markdown with linkify:true on a request hot path can inherit a worker-process denial of service triggerable by a tens-of-KB request body. This issue is fixed in version 5.0.1.CVSS8.7HighEPSS0.39%PrioritiseCVE-2026-59887markdown-it · linkify-it +29 morelinkify-it: Quadratic-complexity DoS via the `mailto:` validator scan-loop on attacker textlinkify-it is a links recognition library with full Unicode support. Prior to 5.0.2, the mailto: schema validator used by .test() and .match() can be invoked at every mailto: occurrence and scan the remaining input through src_email_name in lib/re.mjs, causing O(n^2) CPU consumption on crafted user text. This issue is fixed in version 5.0.2.CVSS7.5HighEPSS0.47%