markdown-it versions prior to 15.0.1 and before 14.3.1 have two independent quadratic time complexity paths when the linkify option is enabled. This causes the event loop to be blocked for tens of seconds when processing a few hundred KB of markdown containing many linkifiable tokens, leading to availability degradation. The issue arises from inefficient array rebuilding and repeated regex matching in markdown-it's own code, not in the linkify-it dependency. The vulnerability affects only applications that enable the linkify option, which is off by default.