Threat Intelligence Database

CVE-2026-59887 is a high-severity vulnerability in the linkify-it library used by markdown-it. Prior to version 5.0.2, the mailto: schema validator could be triggered repeatedly on crafted input, causing quadratic CPU consumption. This inefficient algorithmic complexity leads to a denial-of-service condition by exhausting CPU resources. The issue is fixed in version 5.0.2.

The LinkifyIt package's primary API function, match(), exhibits O(N²) algorithmic complexity when processing inputs with many fuzzy links or emails. This inefficiency stems from a structural issue in the scan loop that repeatedly slices the input string and runs unanchored regex searches on progressively shorter substrings. This behavior causes significant CPU consumption, leading to denial-of-service conditions when rendering untrusted Markdown with linkify enabled in services such as markdown-it. The vulnerability affects all versions prior to 5.0.1.