CVE-2026-48801

Awaiting Analysis Awaiting Analysis - Queue

LinkifyIt Prototype Match O(N²) Complexity Denial of Service

Publication date: 2026-07-14

Last updated on: 2026-07-15

Assigner: GitHub, Inc.

Description

linkify-it is a links recognition library with full Unicode support. Prior to 5.0.1, LinkifyIt.prototype.match, the package's primary public API, has O(N²) algorithmic complexity for inputs containing many fuzzy links or emails because the JavaScript-level scan loop re-slices input and re-runs unanchored regex searches on progressively shorter tails. Any service that synchronously renders untrusted Markdown with linkify:true on a request hot path can inherit a worker-process denial of service triggerable by a tens-of-KB request body. This issue is fixed in version 5.0.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-14

Last Modified

2026-07-15

Generated

2026-08-04

AI Q&A

2026-07-15

EPSS Evaluated

2026-08-02

NVD

CVE-2026-48801

Affected Vendors & Products

Vendor	Product	Version / Range
linkify-it	linkify_it	5.0.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1333	The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.

Attack-Flow Graph

Executive Summary

This vulnerability affects the linkify-it library, which is used to recognize links in text. The issue is in the LinkifyIt.prototype.match function, which has an inefficient O(N²) algorithmic complexity when processing inputs with many fuzzy links or emails. This causes excessive CPU usage, leading to potential denial of service attacks.

Detection Guidance

This vulnerability can be detected by checking the version of linkify-it in use. If your system uses linkify-it and the version is below 5.0.1, it is vulnerable. Commands like 'npm list linkify-it' or inspecting package.json can help identify the installed version.

Impact Analysis

If you use a vulnerable version of linkify-it to render untrusted Markdown with linkify:true on a request hot path, an attacker could send a tens-of-KB request body to cause a worker-process denial of service. This would degrade service availability for other users.

Mitigation Strategies

Upgrade linkify-it to version 5.0.1 or later immediately. If using npm, run 'npm update linkify-it' or update the dependency in package.json to version 5.0.1. For systems using Markdown rendering with linkify enabled, ensure the upgrade is applied to all affected services.

Hi! I’m here to help you understand CVE-2026-48801. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70