linkify-it: Quadratic algorithmic complexity in LinkifyIt#match scan loop
Priority HIGH 77CWE-1333Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 15 fixed, 6 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-1333.
Summary
linkify-it is a links recognition library with full Unicode support. Prior to 5.0.1, LinkifyIt.prototype.match, the package's primary public API, has O(N²) algorithmic complexity for inputs containing many fuzzy links or emails because the JavaScript-level scan loop re-slices input and re-runs unanchored regex searches on progressively shorter tails. Any service that synchronously renders untrusted Markdown with linkify:true on a request hot path can inherit a worker-process denial of service triggerable by a tens-of-KB request body. This issue is fixed in version 5.0.1.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00394 33rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial linkify-it (markdown-it): 5.0.1linkify-it (npm): 5.0.1Red Hat: 21 advisoriesRed Hat: 15 fixed, 6 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| markdown-it | linkify-it | before 5.0.1 | 5.0.1 | Patch available | CNA |
| — | linkify-it (npm) | before 5.0.1 | 5.0.1 | Patch available | GHSA-22p9-wv53-3rq4 |
- linkify-it Vendormarkdown-it Affected before 5.0.1 Fixed in 5.0.1 Patch available CNA
- linkify-it (npm) Vendor— Affected before 5.0.1 Fixed in 5.0.1 Patch available GHSA-22p9-wv53-3rq4
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:markdown-it:linkify-it:*:*:*:*:*:node.js:*:* | before 5.0.1 | Vulnerable | markdown-it |
- cpe:2.3:a:markdown-it:linkify-it:*:*:*:*:*:node.js:*:* Versions before 5.0.1 Vulnerable ·markdown-it
Remediation
- Fix · CNA linkify-it (markdown-it) Fixed in 5.0.1
- Fix · GHSA-22p9-wv53-3rq4 linkify-it (npm) Fixed in 5.0.1 Advisory →
Red Hat 21 advisories
- RHSA-2026:70617 Released 2026-10-01 · Red Hat rating ImportantOpenShift Container Platform 4.18.56 bug fix and security update
- Red Hat OpenShift Container Platform 4.18 registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-service-rhel9-operator +47
- RHSA-2026:70587 Released 2026-10-01 · Red Hat rating ImportantOpenShift Container Platform 4.17.58 bug fix and security update
- Red Hat OpenShift Container Platform 4.17 registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/cloud-network-config-controller-rhel9 +47
- RHSA-2026:67936 Released 2026-09-24 · Red Hat rating ImportantOpenShift Container Platform 4.16.71 bug fix and security update
- Red Hat OpenShift Container Platform 4.16 registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/cloud-network-config-controller-rhel9 +47
Show 18 more Red Hat advisories
- RHSA-2026:68754 Released 2026-09-17 · Red Hat rating ImportantRed Hat OpenShift Dev Spaces 3.30.1 Release.
- Red Hat OpenShift Dev Spaces 3.30 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/dashboard-rhel9, registry.redhat.io/devspaces/openvsx-rhel9 +2
- RHSA-2026:66371 Released 2026-09-16 · Red Hat rating ImportantOpenShift Container Platform 4.19.47 bug fix and security update
- Red Hat OpenShift Container Platform 4.19 registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/ose-agent-installer-csr-approver-rhel9, registry.redhat.io/openshift4/ose-azure-file-csi-driver-rhel9 +8
- RHSA-2026:66377 Released 2026-09-15 · Red Hat rating ImportantOpenShift Container Platform 4.20.38 bug fix and security update
- Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9, registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9 +47
- RHSA-2026:66352 Released 2026-09-15 · Red Hat rating ImportantOpenShift Container Platform 4.21.33 bug fix and security update
- Red Hat OpenShift Container Platform 4.21 registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9, registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9 +47
- RHSA-2026:63047 Released 2026-09-09 · Red Hat rating ImportantOpenShift Container Platform 4.19.46 bug fix and security update
- Red Hat OpenShift Container Platform 4.19 registry.redhat.io/openshift4/egress-router-cni-rhel9, registry.redhat.io/openshift4/ose-baremetal-cluster-api-controllers-rhel9, registry.redhat.io/openshift4/ose-console-rhel9 +4
- RHSA-2026:60446 Released 2026-09-01 · Red Hat rating ImportantOpenShift Container Platform 4.20.36 bug fix and security update
- Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/egress-router-cni-rhel9, registry.redhat.io/openshift4/ose-agent-installer-ui-rhel9, registry.redhat.io/openshift4/ose-azure-cluster-api-controllers-rhel9 +18
- RHSA-2026:60441 Released 2026-09-01 · Red Hat rating ImportantOpenShift Container Platform 4.22.12 bug fix and security update
- Red Hat OpenShift Container Platform 4.22 registry.redhat.io/openshift4/egress-router-cni-rhel9, registry.redhat.io/openshift4/ose-agent-installer-ui-rhel9, registry.redhat.io/openshift4/ose-aws-ebs-csi-driver-rhel9-operator +23
- RHSA-2026:60477 Released 2026-09-01 · Red Hat rating ImportantOpenShift Container Platform 4.21.31 bug fix and security update
- Red Hat OpenShift Container Platform 4.21 registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9, registry.redhat.io/openshift4/egress-router-cni-rhel9, registry.redhat.io/openshift4/oc-mirror-plugin-rhel9 +20
- RHSA-2026:60520 Released 2026-08-27 · Red Hat rating CriticalRHOAI 3.4.4 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9, registry.redhat.io/rhoai/odh-built-in-detector-rhel9 +47
- RHSA-2026:57590 Released 2026-08-20 · Red Hat rating Importantrh-podman-desktop security, bug fix, and enhancement update
- Red Hat Enterprise Linux Extensions Channel (v. 10) rh-podman-desktop-1.1.2-1.el10_2
- RHSA-2026:56431 Released 2026-08-18 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.18.27 security, enhancement & bug fix update
- Red Hat Openshift Data Foundation 4.18 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +16
- RHSA-2026:51038 Released 2026-08-11 · Red Hat rating ImportantOpenShift Container Platform 4.22.9 bug fix and security update
- Red Hat OpenShift Container Platform 4.22 registry.redhat.io/openshift4/ose-agent-installer-ui-rhel9, registry.redhat.io/openshift4/ose-console-rhel9, registry.redhat.io/openshift4/ose-hyperkube-rhel9 +4
- RHSA-2026:51162 Released 2026-08-06 · Red Hat rating ImportantRed Hat Ansible Automation Platform 2.2 security update
- Red Hat Ansible Automation Platform 2.2 registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9
- RHSA-2026:50850 Released 2026-08-05 · Red Hat rating ImportantRed Hat Ansible Automation Platform 2.1 security update
- Red Hat Ansible Automation Platform 2.1 registry.redhat.io/ansible-automation-platform/automation-portal
- RHSA-2026:49642 Released 2026-08-03 · Red Hat rating ImportantRed Hat Developer Hub 1.10.3 release.
- Red Hat Developer Hub 1.10 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator
- RHSA-2026:48126 Released 2026-07-29 · Red Hat rating ImportantRed Hat Developer Hub 1.10.3 Plugin Catalog GA plugins release.
- Red Hat Developer Hub 1.10 registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed, registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend, registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator +4
- RHSA-2026:42815 Released 2026-07-21 · Red Hat rating ImportantRed Hat Ansible Automation Platform 2.2 security update
- Red Hat Ansible Automation Platform 2.2 registry.redhat.io/ansible-automation-platform/automation-portal
- RHSA-2026:38187 Released 2026-07-11 · Red Hat rating ImportantRed Hat Hardened Images RPMs bug fix and enhancement update
- Red Hat Hardened Images cargo-1.97.0-1.1.hum1@aarch64, cargo-1.97.0-1.1.hum1@x86_64, clippy-1.97.0-1.1.hum1@aarch64 +36
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Migration Toolkit for Virtualization | Affected | No fix yet |
| Node HealthCheck Operator | Affected | No fix yet |
| OpenShift Pipelines | Affected | No fix yet |
| Red Hat Build of Podman Desktop | Affected | No fix yet |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat OpenShift Container Platform 5 | Affected | No fix yet |
| Red Hat Ansible Automation Platform 2.1 | Fixed | RHSA-2026:50850 |
| Red Hat Ansible Automation Platform 2.2 | Fixed | RHSA-2026:42815, RHSA-2026:51162 |
| Red Hat Developer Hub 1.10 | Fixed | RHSA-2026:48126, RHSA-2026:49642 |
| Red Hat Enterprise Linux Extensions Channel (v. 10) | Fixed | RHSA-2026:57590 |
| Red Hat Hardened Images | Fixed | RHSA-2026:38187 |
| Red Hat OpenShift AI 3.4 | Fixed | RHSA-2026:60520 |
| Red Hat OpenShift Container Platform 4.16 | Fixed | RHSA-2026:67936 |
| Red Hat OpenShift Container Platform 4.17 | Fixed | RHSA-2026:70587 |
| Red Hat OpenShift Container Platform 4.18 | Fixed | RHSA-2026:70617 |
| Red Hat OpenShift Container Platform 4.19 | Fixed | RHSA-2026:63047, RHSA-2026:66371 |
| Red Hat OpenShift Container Platform 4.20 | Fixed | RHSA-2026:60446, RHSA-2026:66377 |
| Red Hat OpenShift Container Platform 4.21 | Fixed | RHSA-2026:60477, RHSA-2026:66352 |
| Red Hat OpenShift Container Platform 4.22 | Fixed | RHSA-2026:51038, RHSA-2026:60441 |
| Red Hat OpenShift Dev Spaces 3.30 | Fixed | RHSA-2026:68754 |
| Red Hat Openshift Data Foundation 4.18 | Fixed | RHSA-2026:56431 |
Not affected: 14 products
- Red Hat Developer Hub 1.10
- Red Hat Hardened Images
- Red Hat OpenShift AI 3.4
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Container Platform 4.16
- Red Hat OpenShift Container Platform 4.17
- Red Hat OpenShift Container Platform 4.18
- Red Hat OpenShift Container Platform 4.19
- Red Hat OpenShift Container Platform 4.20
- Red Hat OpenShift Container Platform 4.21
- Red Hat OpenShift Container Platform 4.22
- Red Hat OpenShift Dev Spaces 3.30
- Red Hat OpenShift Virtualization 4
- Red Hat Openshift Data Foundation 4.18
Timeline
- 2026-10-02 Threatist record created from CVE-2026-48801
- 2026-10-03 Alias added: GHSA-22p9-wv53-3rq4
- 2026-10-31 Affected versions changed · Red Hat
References
More markdown-it Linkify-it vulnerabilities
- TI-2026-42701 linkify-it: Quadratic-complexity DoS via the `mailto:` validator scan-loop on attacker text CVSS 3.1HIGH 7.5
Sources
- CVE-2026-48801 · CVE Program
- CVE-2026-48801 · NVD
- FIRST EPSS
- GHSA-22p9-wv53-3rq4 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-48801 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences