Denial of Service Vulnerability in LinkifyIt Library by Markdown-it

CVE-2026-48801

What is CVE-2026-48801?

The LinkifyIt library, used for recognizing links with Unicode support, exhibits an O(N²) algorithmic complexity due to inefficient handling of inputs containing many fuzzy links or emails prior to version 5.0.1. The LinkifyIt.prototype.match method suffers from a performance issue where a JavaScript-level scan loop continually re-slices input and re-runs unanchored regex searches. Services that render untrusted Markdown with linkify:true in a synchronous manner, especially during high-traffic requests, could face a denial of service as a result. This vulnerability can be triggered by processing requests containing relatively small payloads, leading to potential service disruptions. Version 5.0.1 addresses this critical performance flaw.

References