2vulnerabilities
- Critical0 (0.0%)
- High2 (100.0%)
- Medium0 (0.0%)
- Moderate0 (0.0%)
- Low0 (0.0%)
linkify-it
Ecosystem: npm
Downloads: 154.65 Mln
- 0CriticalAffects 0 versions
- 2HighAffects 2 versions
- 0MediumAffects 0 versions
- 0ModerateAffects 0 versions
- 0LowAffects 0 versions
Monthly breakdown
- Critical
- High
- Medium
- Moderate
- Low
- 1 vulnerabilities
- Critical: 0
- High: 1
- Medium: 0
- Moderate: 0
- Low: 0
- 1 vulnerabilities
- Critical: 0
- High: 1
- Medium: 0
- Moderate: 0
- Low: 0
Vulnerabilities (2)
Known vulnerabilities affecting linkify-it, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| GHSA-v245-v573-v5vm | High | linkify-it: Quadratic-complexity DoS via the `mailto:` validator scan-loop on attacker text### Summary `linkify-it`'s schema-scan loop (`.test()` / `.match()`, the documented public API) invokes the `mailto:` schema validator at **every** `mailto:` occurrence in the input text. For each occurrence the validator does `text.slice(pos)` (an O(n) copy) and runs an email regex whose local-part class `src_email_name` greedily scans the **entire remaining tail** (O(n)) before failing. With N `mailto:` occurrences that is **N × O(n) = O(n²)**. Because linkify-it runs on arbitrary user text (markdown-it feeds it whole documents when `linkify:true`), an unauthenticated attacker can block the |
| GitHub (opens in a new tab) | |
| GHSA-22p9-wv53-3rq4 | High | LinkifyIt#match scan loop has quadratic algorithmic complexity## Summary `LinkifyIt.prototype.match` — the package's primary public API — has **O(N²) algorithmic complexity** for inputs containing many fuzzy links or emails. This is not a regex backtrack bug; it's a structural issue in the JS-level scan loop that re-slices the input and re-runs unanchored regex searches on progressively shorter tails, N times. 64 KB of `"a@b.com\n"` repeated burns ~2.5 s of single-threaded CPU; 128 KB takes ~10 s. Doubling the input quadruples the time — textbook O(N²). The same cost passes through `markdown-it` (`linkify:true`) unmodified. Any service that synchronou |
| GitHub (opens in a new tab) |
- GHSA-v245-v573-v5vmHighlinkify-it: Quadratic-complexity DoS via the `mailto:` validator scan-loop on attacker text
< 5.0.2
### Summary `linkify-it`'s schema-scan loop (`.test()` / `.match()`, the documented public API) invokes the `mailto:` schema validator at **every** `mailto:` occurrence in the input text. For each occurrence the validator does `text.slice(pos)` (an O(n) copy) and runs an email regex whose local-part class `src_email_name` greedily scans the **entire remaining tail** (O(n)) before failing. With N `mailto:` occurrences that is **N × O(n) = O(n²)**. Because linkify-it runs on arbitrary user text (markdown-it feeds it whole documents when `linkify:true`), an unauthenticated attacker can block the
CVE: CVE-2026-59887
- GHSA-22p9-wv53-3rq4HighLinkifyIt#match scan loop has quadratic algorithmic complexity
< 5.0.1
## Summary `LinkifyIt.prototype.match` — the package's primary public API — has **O(N²) algorithmic complexity** for inputs containing many fuzzy links or emails. This is not a regex backtrack bug; it's a structural issue in the JS-level scan loop that re-slices the input and re-runs unanchored regex searches on progressively shorter tails, N times. 64 KB of `"a@b.com\n"` repeated burns ~2.5 s of single-threaded CPU; 128 KB takes ~10 s. Doubling the input quadruples the time — textbook O(N²). The same cost passes through `markdown-it` (`linkify:true`) unmodified. Any service that synchronou
CVE: CVE-2026-48801