Executive brief
LinkifyIt is a JavaScript library used by markdown-it and other tools to detect and extract URLs and email addresses from text. The match() function—the library's primary API—exhibits O(N²) algorithmic complexity, meaning processing time quadruples when input size doubles. An attacker can send a service tens of kilobytes of specially crafted text (repeated email patterns) to block a server worker thread for seconds or minutes, causing a denial of service for all users relying on that worker.
Technical details
LinkifyIt.prototype.match() contains a structural algorithmic flaw in its scan loop (index.mjs:528–554) that re-slices the input string on each iteration and re-runs three unanchored regex searches against progressively shorter tails. The outer loop iterates O(N) times per match discovered, and each iteration performs O(N) work via string allocation and full-text regex searches, resulting in Σ(N − i*c) = O(N²) total cost. The vulnerable code calls text.search() and text.match() on the full tail for host_fuzzy_test, link_fuzzy, and email_fuzzy regex patterns, whereas the schema-prefixed branch in the same function correctly uses stateful g-flag regex iteration with lastIndex advancement. Proof-of-concept: 64 KB of "a@b.com\n" repeated consumes ~2.5 seconds of single-threaded CPU; 128 KB consumes ~10 seconds. The same quadratic cost propagates transparently through markdown-it's render() when linkify:true is enabled. No authentication or user interaction is required—an HTTP POST containing tens of KB of email-like patterns triggers the DoS. The vulnerability affects all versions from the 2014 initial commit through v5.0.0; a fix was released in v5.0.1 by converting the scan to stateful regex iteration with pos offset advancement instead of string slicing.
Affected products
- markdown-it linkify-it <= 5.0.0
Timeline
- 2026-05-23: disclosed
- 2026-05-23: patched: Version 5.0.1 released with algorithmic fix