ReDoS via mailto: Schema in linkify-it

Executive Summary

CVE-2026-59887 is a Denial of Service (DoS) vulnerability in the linkify-it library, which is used for recognizing links with full Unicode support. The issue occurs in versions 5.0.1 and earlier, where the mailto: schema validator repeatedly scans the remaining input for each mailto: occurrence using a regex that causes quadratic time complexity (O(n²)) on crafted inputs.

Specifically, the validator performs an O(n) slice and a greedy regex match on the entire remaining string for every mailto: prefix, which leads to excessive CPU consumption when processing attacker-controlled input containing many mailto: strings.

This vulnerability can be triggered by submitting inputs with many repeated mailto: prefixes, causing the event loop to block for several seconds or longer, effectively causing a denial of service.

Useful 0 Not Useful 0

Impact Analysis

The primary impact of this vulnerability is a denial of service due to high CPU consumption caused by the inefficient mailto: validator.

• An attacker can craft input with many mailto: prefixes (e.g., 220 KB of repeated mailto:) that causes the event loop to hang for several seconds or longer.
• This can lead to availability issues in applications that use linkify-it with linkify mode enabled, such as comment sections, chat applications, forums, and note-taking apps that render user-provided markdown.
• The denial of service can degrade user experience or cause service outages by blocking the event loop.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by identifying if your system or application uses the linkify-it library version 5.0.1 or earlier, especially in contexts where user input is processed with the .test() or .match() methods involving mailto: links.

Detection can also involve monitoring for unusually high CPU usage or event loop blocking when processing inputs containing many repeated "mailto:" strings, which may indicate exploitation attempts.

Specific commands to detect the vulnerability are not provided in the available resources.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade the linkify-it library to version 5.0.2 or later, where the vulnerability has been fixed.

The fix involves bounding the length of the email local-part to 64 characters and limiting the scanning behavior to avoid O(n²) CPU consumption.

If upgrading immediately is not possible, consider disabling or restricting the use of linkify-it's mailto: schema validation or avoiding processing untrusted user input with the vulnerable methods.

Useful 0 Not Useful 0

Compliance Impact

CVE-2026-59887 is a denial-of-service (DoS) vulnerability that primarily impacts availability by causing the event loop to block for several seconds or longer when processing crafted inputs. This can affect systems that rely on markdown-it's linkify mode for rendering user-provided markdown, such as comment sections, chat applications, forums, and note-taking apps.

While the vulnerability does not directly involve confidentiality or integrity breaches, the resulting availability issues could indirectly impact compliance with standards like GDPR or HIPAA if critical services become unavailable or unresponsive, potentially affecting the timely processing or access to personal or sensitive data.

However, there is no explicit information in the provided context or resources linking this vulnerability to specific compliance violations or regulatory impacts.

Useful 0 Not Useful 0