LinkifyIt.prototype.match has a quadratic time complexity due to its scan loop design. Each iteration slices the input tail and performs multiple unanchored regex searches, resulting in O(N²) processing time for inputs with many fuzzy links or emails. This inefficiency propagates to markdown-it when linkify:true is enabled, causing synchronous rendering of large inputs to block worker threads for seconds or longer. The vulnerability has existed since the initial commit and affects all versions before 5.0.1. The recommended fix is to refactor the loop to use stateful regex iteration with the 'g' flag to achieve linear time complexity.

This vulnerability primarily impacts availability by enabling a denial-of-service condition. A single HTTP request containing tens of kilobytes of repeated email-like strings can block a worker thread for several seconds to tens of seconds. Under moderate concurrent load, this can wedge the entire rendering tier of affected services. There is no impact on confidentiality or integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The suggested remediation is an algorithmic fix converting the outer scan loop to stateful regex iteration with the 'g' flag to ensure linear time complexity. Until a patch is available, consider disabling linkify or avoiding rendering untrusted Markdown with linkify enabled on request hot-paths to mitigate denial-of-service risks.