CVE-2026-48801 linkify-it: Quadratic algorithmic complexity in LinkifyIt#match scan loop
Attackers can cause denial of service in services using linkify-it by sending crafted inputs that trigger quadratic algorithmic complexity.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-48801?
CVE-2026-48801 is a high-severity denial of service vulnerability in markdown-it linkify-it, published on 14 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
linkify-it is a links recognition library with full Unicode support. Prior to 5.0.1, LinkifyIt.prototype.match, the package's primary public API, has O(N²) algorithmic complexity for inputs containing many fuzzy links or emails because the JavaScript-level scan loop re-slices input and re-runs unanchored regex searches on progressively shorter tails. Any service that synchronously renders untrusted Markdown with linkify:true on a request hot path can inherit a worker-process denial of service triggerable by a tens-of-KB request body. This issue is fixed in version 5.0.1.
Weakness: CWE-1333
Which versions are affected by CVE-2026-48801?
2 open source packages ship an affected version, including linkify-it. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
linkify-it npm | All versions | 5.0.1 |
linkify-it npm | All versions | 5.0.1 |
Products include Markdown-It Linkify-It.
How do I fix CVE-2026-48801?
Upgrade linkify-it to 5.0.1 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-48801 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-48801 exists.
Other vulnerabilities in markdown-it linkify-it
Sources
Also known as CLEANSTART-2026-DU00914, CLEANSTART-2026-VG66348, CLSA-2026-1791290211, CLSA-2026-1792767578, CLSA-2026-1792776237, ECHO-50e9-36d3-e3c3 and 28 more.