Skip to main content

linkify-it CVE-2026-59887

| EUVDEUVD-2026-42321 HIGH
Inefficient Algorithmic Complexity (CWE-407)
2026-07-08 GitHub_M GHSA-v245-v573-v5vm
Information Disclosure Markdown It Linkify It
High
Disputed · 7.5 Vendor: GitHub_M
Share

Severity by source

Sources disagree (Low–High)
Vendor (GitHub_M) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
7.5 HIGH

Untrusted text reaches the parser without auth or interaction (AV:N/AC:L/PR:N/UI:N); impact is CPU exhaustion only, so C:N/I:N and A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
3.3 LOW
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Red Hat
7.5 HIGH
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: GitHub_M

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

2
Patch available
Jul 08, 2026 - 18:02 EUVD
Analysis Generated
Jul 08, 2026 - 16:55 vuln.today

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 15,540 npm packages depend on linkify-it (278 direct, 15,270 indirect)

Ecosystem-wide dependent count for version 5.0.2.

DescriptionCVE.org

linkify-it is a links recognition library with full Unicode support. Prior to 5.0.2, the mailto: schema validator used by .test() and .match() can be invoked at every mailto: occurrence and scan the remaining input through src_email_name in lib/re.mjs, causing O(n^2) CPU consumption on crafted user text. This issue is fixed in version 5.0.2.

AnalysisAI

Denial of service in linkify-it before 5.0.2 allows remote attackers to exhaust CPU by submitting crafted text containing many mailto: occurrences, each triggering the src_email_name email-name validator in lib/re.mjs to rescan the remaining input, yielding O(n^2) complexity. Any application that runs untrusted user text through linkify-it's .test() or .match() is affected; there is no public exploit identified at time of analysis and the flaw is not in CISA KEV, but the low complexity of the trigger makes availability disruption straightforward.

Technical ContextAI

linkify-it is a widely embedded JavaScript URL/email autolinking library, most notably a dependency of markdown-it, used to detect links and email addresses inside arbitrary text. The root cause maps to CWE-407 (Inefficient Algorithmic Complexity): the mailto: schema validator is re-invoked at every 'mailto:' substring, and for each invocation the src_email_name regular expression in lib/re.mjs scans the remainder of the input rather than a bounded window. Repeated overlapping scans over the same tail of the string produce quadratic O(n^2) work relative to input length, so a modestly sized but adversarially structured input consumes disproportionate CPU on the parsing thread. The CPE cpe:2.3:a:markdown-it:linkify-it confirms the affected package is the markdown-it project's linkify-it.

RemediationAI

Vendor-released patch: 5.0.2 - upgrade linkify-it to 5.0.2 or later, and rebuild/redeploy any dependents (such as markdown-it) so the transitive dependency resolves to the fixed version; the corresponding upstream fix is commit 105e5d77f7d119871d2b2d86ed208568eb3e7ffe and is documented in advisory GHSA-v245-v573-v5vm (https://github.com/markdown-it/linkify-it/security/advisories/GHSA-v245-v573-v5vm). If immediate upgrade is not possible, reduce exposure by capping the maximum length of untrusted text passed to .test()/.match() so the quadratic term stays bounded (side effect: very long legitimate inputs get truncated), and by moving linkification into a worker thread or a time-bounded/queued job so a single crafted input cannot stall the main request thread (side effect: added architectural complexity and latency). Where linkification of user content is non-essential, disabling autolinking on untrusted fields entirely removes the attack surface at the cost of losing clickable-link detection.

More in Markdown It

View all
CVE-2025-7969 MEDIUM POC
6.9 Aug 21

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in markdown-it
CVE-2015-3295 MEDIUM
5.3 Jun 07

markdown-it before 4.1.0 does not block data: URLs. Rated medium severity (CVSS 5.3), this vulnerability is remotely exp
CVE-2026-2327 MEDIUM
5.3 Feb 12

Markdown-It versions up to 14.1.1 is affected by inefficient regular expression complexity (redos) (CVSS 5.3).

Same weakness CWE-407 – Inefficient Algorithmic Complexity

View all
CVE-2026-59094 HIGH POC
8.7
CVE-2026-71321 HIGH POC
7.5
CVE-2026-73643 HIGH POC
7.5
CVE-2024-9631 HIGH POC
7.5
CVE-2026-27903 HIGH POC
7.5
CVE-2026-3988 HIGH POC
7.5
CVE-2026-45186 HIGH POC
7.5
CVE-2024-8233 HIGH POC
7.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Low
Product Status
SUSE Linux Enterprise High Performance Computing 12 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise Module for Web and Scripting 15 SP7 Not-Affected
SUSE Linux Enterprise Module for Web and Scripting 15 SP7 Not-Affected

Share

CVE-2026-59887 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy