Description
LinkifyIt.prototype.match — the package’s primary public API — has O(N²) algorithmic complexity for inputs containing many fuzzy links or emails. This is not a regex backtrack bug; it’s a structural issue in the JS-level scan loop that re-slices the input and re-runs unanchored regex searches on progressively shorter tails, N times.
Recommendation
Update the linkify-it package to the latest compatible version. Followings are version details:
- Affected version(s): <= 5.0.0
- Patched version(s): 5.0.1
References
Related Issues
- linkify-it: Quadratic-complexity DoS via the `mailto:` validator scan-loop on attacker text - CVE-2026-59887
- Claw Orchestrator has inefficient regular expression complexity via validateRegex() - CVE-2026-10291
- LiquidJS Has Memory Limit Bypass via Quadratic Amplification in `replace` Filter - CVE-2026-34166
- markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations - CVE-2026-48988
You might also like:
- Tags:
- npm
- linkify-it
Anything's wrong? Let us know Last updated on June 26, 2026