Denial of Service Vulnerability in linkify-it Library Affecting Markdown-it
CVE-2026-59887

7.5HIGH

Key Information:

Vendor: Markdown-it
Status: Linkify-it
Vendor: CVE Published:; 8 July 2026

🔔 Create Markdown-it Vulnerability Alert

What is CVE-2026-59887?

The linkify-it library, which is utilized for link recognition with full Unicode support, contains a vulnerability prior to version 5.0.2. This flaw arises from inefficient processing in the mailto: schema validator, invoked through the .test() and .match() functions. When a crafted string containing mailto: links is processed, it triggers a potentially significant CPU resource drain due to O(n^2) complexity in evaluating the user input. This can render applications using the library vulnerable to denial of service attacks.