CVE-2026-48801 Details

A denial-of-service vulnerability has been identified in the Linkify-It library, prior to version 5.0.1. The issue arises in the primary public API, LinkifyIt.prototype.match, which exhibits O(N²) algorithmic complexity when processing inputs with numerous fuzzy links or email addresses. This inefficiency is caused by the JavaScript-level scan loop, which repeatedly slices the input and executes unanchored regular expression searches on progressively shorter tails. As a result, services that synchronously render untrusted Markdown with linkify enabled, particularly on high-traffic request paths, can experience significant performance degradation. The vulnerability is effectively a worker-process denial-of-service, triggered by a request body of just a few tens of kilobytes.

Users can upgrade to Linkify-It version 5.0.1 or later, where this vulnerability has been fixed. Additionally, services using the Markdown-It library should be aware of this vulnerability, as it can be exploited through Markdown rendering with linkify enabled.