linkify-it: Quadratic-complexity DoS via the `mailto:` validator scan-loop on attacker text
- Severity:
- High
Description
linkify-it’s schema-scan loop (.test() / .match(), the documented public API) invokes the mailto: schema validator at every mailto: occurrence in the input text. For each occurrence the validator does text.slice(pos) (an O(n) copy) and runs an email regex whose local-part class src_email_name greedily scans the entire remaining tail (O(n)) before failing. With N mailto: occurrences that is N × O(n) = O(n²).
Recommendation
Update the linkify-it package to the latest compatible version. Followings are version details:
- Affected version(s): <= 5.0.1
- Patched version(s): 5.0.2
References
Related Issues
- LinkifyIt#match scan loop has quadratic algorithmic complexity - CVE-2026-48801
- markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations - CVE-2026-48988
- Claw Orchestrator has inefficient regular expression complexity via validateRegex() - CVE-2026-10291
- Mermaid XY Charts are vulnerable to an infinite loop DoS - CVE-2026-71436
You might also like:
- Tags:
- npm
- linkify-it
Anything's wrong? Let us know Last updated on July 21, 2026