VulnerabilityPublished 14 Jul 2026

CVE-2026-48801: Linkify it · LinkifyIt#match scan loop has quadratic algorithmic complexity

Affects linkify-itSource GCVE Database

Not known to be exploited : upgrade to 5.0.1 when convenient.

Data as of 26 Oct 2026, 09:16 UTC

Severity

Medium

Rated by Threat Radar · No CVSS score from NVD or the CNA

EPSS: 0.3% chance of exploitation in 30 days – higher than 33% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in 5.0.1

Exploitation evidence

Disclosed: evidence found.
CVE published 14 Jul 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade linkify-it to 5.0.1.

Affected software

Product	Affected	Fixed in
npmlinkify-it	Affected <5.0.1	Fixed in 5.0.1
Ubuntu:22.04:LTSnode-markdown-it`pkg:deb/ubuntu/node-markdown-it?arch=source&distro=jammy`Other threats	Affected =10.0.0+dfsg-2 =10.0.0+dfsg-3 =10.0.0+dfsg-3.1 =10.0.0+dfsg-4 =10.0.0+dfsg-5 =10.0.0+dfsg-6	Fixed in–
Ubuntu:24.04:LTSnode-markdown-it`pkg:deb/ubuntu/node-markdown-it?arch=source&distro=noble`Other threats	Affected =22.2.3+dfsg+~12.2.3-2	Fixed in–
Ubuntu:26.10node-markdown-it`pkg:deb/ubuntu/node-markdown-it?arch=source&distro=stonking`Other threats	Affected =22.2.3+dfsg+~12.2.3-4 =22.2.3+dfsg+~12.2.3-5	Fixed in–
Ubuntu:26.04:LTSnode-markdown-it`pkg:deb/ubuntu/node-markdown-it?arch=source&distro=resolute`Other threats	Affected =22.2.3+dfsg+~12.2.3-2 =22.2.3+dfsg+~12.2.3-4	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

Upgrade to markdown-it version 5.0.1 or later, where this issue is fixed. If upgrading immediately is not possible, avoid enabling linkify:true on untrusted Markdown inputs processed synchronously on request hot paths to reduce exposure. Patch status is confirmed fixed in version 5.0.1.

Description

The Node.js package markdown-it, specifically its linkify-it component prior to version 5.0.1, contains an algorithmic complexity vulnerability in the LinkifyIt.prototype.match function. This function exhibits O(N²) complexity when processing inputs with many fuzzy links or emails due to repeated rescanning of progressively shorter input tails. This can lead to denial of service (DoS) conditions if untrusted Markdown with linkify enabled is synchronously rendered on a request hot path. The issue is resolved in version 5.0.1.

Impact

An attacker can cause a denial of service by sending a request containing a large Markdown body with many fuzzy links or emails, triggering excessive CPU consumption in the vulnerable linkify-it matching function. This leads to worker process exhaustion or significant performance degradation. There is no impact on confidentiality or integrity. The vulnerability affects availability only.

Summary

linkify-it is a Unicode-compliant link recognition library used by markdown-it. Before version 5.0.1, its primary API method, LinkifyIt.prototype.match, suffers from quadratic time complexity (O(N²)) when handling inputs containing numerous fuzzy links or email addresses. This inefficiency arises because the JavaScript implementation repeatedly re-slices the input string and performs unanchored regular expression searches on shorter and shorter substrings. Consequently, services that synchronously render untrusted Markdown with linkify:true enabled on performance-critical request paths may be vulnerable to denial of service triggered by relatively large request bodies. The vulnerability is fixed in version 5.0.1.

CWE-1333Inefficient Regular Expression Complexity (opens in a new tab)
Base weaknessLikelihood of exploit: High
The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.
Architecture and Design
Use regular expressions that do not support backtracking, e.g. by removing nested quantifiers.
System Configuration
Set backtracking limits in the configuration of the regular expression implementation, such as PHP's pcre.backtrack_limit. Also consider limits on execution time for the process.
Implementation
Do not use regular expressions with untrusted input. If regular expressions must be used, avoid using backtracking in the expression.
OWASP Cheat Sheets
File Upload (opens in a new tab)
OWASP ASVS 4.0.3
V12.1.1 (opens in a new tab)
Attack patterns
Regular Expression Exponential Blowup (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 8 Aug 2026, 16:59 UTC

WeaknessesCWE-1333

Technical details

References

Community reviews

Related threats