The markdown-it library has two separate quadratic complexity issues in its linkify: true handling. First, the arrayReplaceAt function is called repeatedly per linkified text token, rebuilding a large children array multiple times, causing O(N^2) behavior when many soft-broken lines are present. Second, a regex match on the input string is performed repeatedly at every '://' occurrence without truncation unless a link is produced, causing repeated rescanning and further quadratic complexity. These inefficiencies cause the event loop to be blocked for tens of seconds on inputs of a few hundred KB, severely impacting availability. The problem is in markdown-it's own code, not in the linkify-it dependency, and only affects usage with linkify enabled.

This vulnerability causes significant availability degradation by blocking the Node.js event loop for tens of seconds when processing markdown inputs of a few hundred KB with linkify enabled. The blocking time grows quadratically with input size, making the application unresponsive during processing. There is no impact on confidentiality, integrity, or code execution. The issue only affects applications that explicitly enable the linkify option, which is off by default.

A patch is available for this vulnerability. Users should upgrade markdown-it to version 15.0.1 or later, or any version after 14.3.1 where this issue is fixed. If upgrading is not immediately possible, disabling the linkify option will avoid the quadratic performance degradation. Since linkify is off by default, applications not enabling it are not affected.