7.5

CVE-2026-59887: linkify-it: Quadratic-complexity DoS via the `mailto:` validator scan-loop on attacker text

Analyzed
AliasesCGA-gg9q-cx9j-5jgrCGA-j3r7-72fg-w57qGHSA-v245-v573-v5vm
Published 08-07-2026Last modified 09-07-2026

Vulnerability summary

CVE-2026-59887 is a high (CVSS 7.5) Inefficient Algorithmic Complexity vulnerability in markdown-it linkify-it. EPSS estimates a 0.47% chance of exploitation in the next 30 days, higher than 40.4% of scored vulnerabilities. 1 public exploit is recorded.

Priority
Prioritisepublic exploit

Public exploit (GitHub, Date unknown)

Source freshness unavailable

How is this decided?
CVSS score
7.5/10
010
High · v3.1 (CVE.org)
EPSS score
0.47%
0%100%
Low · -0.18 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits1github

Advisory lineage

Upstream 0 · Downstream 1 · Related 1
MGASA-2026-0377CGA-MH2Q-HM6H-9FCM

Timeline

  1. 08-07-2026
    PublishedVulnerability first disclosed.
  2. 09-07-2026
    Last modifiedVulnerability information updated.

Description

linkify-it is a links recognition library with full Unicode support. Prior to 5.0.2, the mailto: schema validator used by .test() and .match() can be invoked at every mailto: occurrence and scan the remaining input through src_email_name in lib/re.mjs, causing O(n^2) CPU consumption on crafted user text. This issue is fixed in version 5.0.2.

CVSS metrics

5 scores · 5 sources · 1 version

EPSS trend

Probability

0.47%

Chance of exploitation in the next 30 days

Percentile

40%

Versus all other CVEs

30-day change

Decrease -0.18 pp

From 0.64% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found
  • githubUnverified

    Linkify It

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard27 products
  • argo-workflows-ui-4.0< 4.0.11-r0
  • gitlab-rails-ce-18.1< 18.1.6-r24
  • gitlab-rails-ce-18.10All versions (No fix recorded)
  • gitlab-rails-ce-18.6All versions (No fix recorded)
  • gitlab-rails-ce-18.7All versions (No fix recorded)
Markdown-it1 product
Npm1 product
  • linkify-it< 5.0.2
Wolfi1 product
  • argo-workflows-ui-4.0< 4.0.11-r0

4 vendors · 30 products

References

6 links