Node markdown it: Prior to 5.0.1, LinkifyIt.prototype.match, the package's primary public API, has O(N²) algorithmic complexity for inputs containing many fuzzy links… (CVE-2026-48801)
The Node.js package markdown-it, specifically its linkify-it component prior to version 5.0.1, contains an algorithmic complexity vulnerability in the LinkifyIt.prototype.match function. This function exhibits O(N²) complexity when processing inputs with many fuzzy links or emails due to repeated rescanning of progressively shorter input tails. This can lead to denial of service (DoS) conditions if untrusted Markdown with linkify enabled is synchronously rendered on a request hot path. The issue is resolved in version 5.0.1.
AI Analysis
Technical Summary
linkify-it is a Unicode-compliant link recognition library used by markdown-it. Before version 5.0.1, its primary API method, LinkifyIt.prototype.match, suffers from quadratic time complexity (O(N²)) when handling inputs containing numerous fuzzy links or email addresses. This inefficiency arises because the JavaScript implementation repeatedly re-slices the input string and performs unanchored regular expression searches on shorter and shorter substrings. Consequently, services that synchronously render untrusted Markdown with linkify:true enabled on performance-critical request paths may be vulnerable to denial of service triggered by relatively large request bodies. The vulnerability is fixed in version 5.0.1.
Potential Impact
An attacker can cause a denial of service by sending a request containing a large Markdown body with many fuzzy links or emails, triggering excessive CPU consumption in the vulnerable linkify-it matching function. This leads to worker process exhaustion or significant performance degradation. There is no impact on confidentiality or integrity. The vulnerability affects availability only.
Mitigation Recommendations
Upgrade to markdown-it version 5.0.1 or later, where this issue is fixed. If upgrading immediately is not possible, avoid enabling linkify:true on untrusted Markdown inputs processed synchronously on request hot paths to reduce exposure. Patch status is confirmed fixed in version 5.0.1.
Node markdown it: Prior to 5.0.1, LinkifyIt.prototype.match, the package's primary public API, has O(N²) algorithmic complexity for inputs containing many fuzzy links… (CVE-2026-48801)
Description
The Node.js package markdown-it, specifically its linkify-it component prior to version 5.0.1, contains an algorithmic complexity vulnerability in the LinkifyIt.prototype.match function. This function exhibits O(N²) complexity when processing inputs with many fuzzy links or emails due to repeated rescanning of progressively shorter input tails. This can lead to denial of service (DoS) conditions if untrusted Markdown with linkify enabled is synchronously rendered on a request hot path. The issue is resolved in version 5.0.1.
CVSS v3.1
Score 7.5high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
linkify-it is a Unicode-compliant link recognition library used by markdown-it. Before version 5.0.1, its primary API method, LinkifyIt.prototype.match, suffers from quadratic time complexity (O(N²)) when handling inputs containing numerous fuzzy links or email addresses. This inefficiency arises because the JavaScript implementation repeatedly re-slices the input string and performs unanchored regular expression searches on shorter and shorter substrings. Consequently, services that synchronously render untrusted Markdown with linkify:true enabled on performance-critical request paths may be vulnerable to denial of service triggered by relatively large request bodies. The vulnerability is fixed in version 5.0.1.
Potential Impact
An attacker can cause a denial of service by sending a request containing a large Markdown body with many fuzzy links or emails, triggering excessive CPU consumption in the vulnerable linkify-it matching function. This leads to worker process exhaustion or significant performance degradation. There is no impact on confidentiality or integrity. The vulnerability affects availability only.
Mitigation Recommendations
Upgrade to markdown-it version 5.0.1 or later, where this issue is fixed. If upgrading immediately is not possible, avoid enabling linkify:true on untrusted Markdown inputs processed synchronously on request hot paths to reduce exposure. Patch status is confirmed fixed in version 5.0.1.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-22p9-wv53-3rq4
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-48801"]
- Ecosystems
- ["npm"]
- Database Specific Severity
- HIGH
- Cvss Version
- 4.0
Threat ID: 6a3ef76a27e9c79719fee800
Added to database: 06/26/2026, 22:04:26 UTC
Last enriched: 08/08/2026, 16:59:57 UTC
Last updated: 09/13/2026, 10:01:31 UTC
Views: 180
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.