Description
Two independent quadratic paths in the linkify: true handling. Both are in markdown-it’s own code rather than in linkify-it, which stays linear on both payloads.
src/rules_core/linkify.ts calls arrayReplaceAt once per linkified text token, and that rebuilds the whole children array each time.
Recommendation
Update the markdown-it package to the latest compatible version. Followings are version details:
Affected version(s): **< 14.3.1 = 15.0.0** Patched version(s): **14.3.1 15.0.1**
References
Could your website be exposed too?
SmartScanner can check your website for markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of sec and gives you actionable findings to investigate.
Start a free scanRelated Issues
- parse-duration has a Regex Denial of Service that results in event loop delay and out of memory - CVE-2025-25283
- markdown-it is has a Regular Expression Denial of Service (ReDoS) - CVE-2026-2327
- LiquidJS has an infinite loop vulnerability in its `strip_html` filter - CVE-2026-61556
- linkify-it: Quadratic-complexity DoS via the `mailto:` validator scan-loop on attacker text - CVE-2026-59887
You might also like:
See something that needs correcting? Let us knowUpdated November 02, 2026