Executive brief
A vulnerability in the linkify-it library, commonly used in markdown editors and chat systems to detect URLs and email addresses, allows an attacker to crash or slow down a service. By providing a specially crafted text containing many "mailto:" prefixes, an attacker can force the system into a long-running calculation that blocks other users from accessing the application. This primarily impacts the availability of web platforms like forums, wikis, and comment sections.
Technical details
The linkify-it library's schema-scan loop invokes the 'mailto:' validator for every occurrence of the string in the input. The validator performs an O(n) string slice and then executes a regular expression with a greedy local-part class that scans the entire remaining tail of the input. When an attacker provides N occurrences of 'mailto:', the resulting complexity is O(n²), which can block the Node.js single-threaded event loop for several seconds with relatively small inputs (e.g., ~300 KB). This is an inefficient algorithmic complexity issue (CWE-407) rooted in the 'mailto:' validation logic in index.mjs and lib/re.mjs. The vulnerability is patched in version 5.0.2 by bounding the email local-part length and optimizing the regex execution.
Affected products
- markdown-it linkify-it <= 5.0.1
Timeline
- 2026-07-02: patched: Version 5.0.2 released
- 2026-07-08: advisory: NVD published CVE-2026-59887
- 2026-07-21: advisory: GitHub Advisory published