CVE-2026-59887 Details
Description
linkify-it is a links recognition library with full Unicode support. Prior to 5.0.2, the mailto: schema validator used by .test() and .match() can be invoked at every mailto: occurrence and scan the remaining input through src_email_name in lib/re.mjs, causing O(n^2) CPU consumption on crafted user text. This issue is fixed in version 5.0.2.
A denial-of-service vulnerability has been identified in the linkify-it library, prior to version 5.0.2. The issue arises in the mailto schema validator, which is used by the .test() and .match() methods. This validator can be triggered for each occurrence of mailto:, scanning the remaining input with a regex that causes quadratic CPU consumption on crafted user text. The vulnerability is present in versions through 5.0.1.
Users can upgrade to linkify-it version 5.0.2, which addresses the vulnerability by capping the length of the email local-part to 64 characters, as per RFC 5321. This change prevents the quadratic-time complexity by ensuring that the validation process does not rescan the entire input tail.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/markdown-it/linkify-it/security/advisories/GHSA-v245-v573-v5vm | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/markdown-it/linkify-it/commit/105e5d77f7d119871d2b2d86ed208568eb3e7ffe | [email protected] | Patch |
| https://github.com/markdown-it/linkify-it/releases/tag/5.0.2 | [email protected] | Release Notes |
| https://github.com/markdown-it/linkify-it/security/advisories/GHSA-v245-v573-v5vm | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-407 | Inefficient Algorithmic Complexity | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| markdown-it linkify-it | < 5.0.2 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 26, 2026 | Initial Analysis | [email protected] |
| Jul 9, 2026 | CVE Modified | CISA-ADP |
| Jul 8, 2026 | New CVE Received | [email protected] |