linkify-it: Quadratic-complexity DoS via the `mailto:` validator scan-loop on attacker text
Priority HIGH 72CWE-407Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 8 fixed, 7 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-407.
Summary
linkify-it is a links recognition library with full Unicode support. Prior to 5.0.2, the mailto: schema validator used by .test() and .match() can be invoked at every mailto: occurrence and scan the remaining input through src_email_name in lib/re.mjs, causing O(n^2) CPU consumption on crafted user text. This issue is fixed in version 5.0.2.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00467 40th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial linkify-it (markdown-it): 5.0.2linkify-it (npm): 5.0.2Red Hat: 8 advisoriesRed Hat: 8 fixed, 7 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| markdown-it | linkify-it | before 5.0.2 | 5.0.2 | Patch available | CNA |
| — | linkify-it (npm) | before 5.0.2 | 5.0.2 | Patch available | GHSA-v245-v573-v5vm |
- linkify-it Vendormarkdown-it Affected before 5.0.2 Fixed in 5.0.2 Patch available CNA
- linkify-it (npm) Vendor— Affected before 5.0.2 Fixed in 5.0.2 Patch available GHSA-v245-v573-v5vm
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:markdown-it:linkify-it:*:*:*:*:*:node.js:*:* | before 5.0.2 | Vulnerable | markdown-it |
- cpe:2.3:a:markdown-it:linkify-it:*:*:*:*:*:node.js:*:* Versions before 5.0.2 Vulnerable ·markdown-it
Remediation
- Fix · CNA linkify-it (markdown-it) Fixed in 5.0.2
- Fix · GHSA-v245-v573-v5vm linkify-it (npm) Fixed in 5.0.2 Advisory →
Red Hat 8 advisories
- RHSA-2026:89839 Released 2026-10-27 · Red Hat rating ImportantOpenShift Container Platform 4.14.77 bug fix and security update
- Red Hat OpenShift Container Platform 4.14 registry.redhat.io/openshift4/cloud-network-config-controller-rhel8, registry.redhat.io/openshift4/egress-router-cni-rhel8, registry.redhat.io/openshift4/kubevirt-csi-driver-rhel8 +47
- RHSA-2026:89715 Released 2026-10-27 · Red Hat rating ImportantOpenShift Container Platform 4.16.74 bug fix and security update
- Red Hat OpenShift Container Platform 4.16 registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/cloud-network-config-controller-rhel9 +47
- RHSA-2026:90321 Released 2026-10-26 · Red Hat rating CriticalRed Hat OpenShift Dev Spaces 3.31.0 Release.
- Red Hat OpenShift Dev Spaces 3.31 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/dashboard-rhel9, registry.redhat.io/devspaces/jetbrains-ide-rhel9 +8
Show 5 more Red Hat advisories
- RHSA-2026:84734 Released 2026-10-19 · Red Hat rating CriticalRHOAI 3.4.5 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-ai-gateway-payload-processing-rhel9, registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9 +47
- RHSA-2026:83663 Released 2026-10-15 · Red Hat rating ImportantMTV RHEL9 Images
- Migration Toolkit for Virtualization 2.10 registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9, registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9, registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9
- RHSA-2026:83662 Released 2026-10-15 · Red Hat rating ImportantMTV RHEL9 Images
- Migration Toolkit for Virtualization 2.11 registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9, registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9, registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9 +1
- RHSA-2026:74609 Released 2026-10-01 · Red Hat rating ImportantCluster Observability Operator 1.5.3
- Cluster Observability Operator 1.5 registry.redhat.io/cluster-observability-operator/alertmanager-rhel9, registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator, registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9 +13
- RHSA-2026:68754 Released 2026-09-17 · Red Hat rating ImportantRed Hat OpenShift Dev Spaces 3.30.1 Release.
- Red Hat OpenShift Dev Spaces 3.30 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/dashboard-rhel9, registry.redhat.io/devspaces/openvsx-rhel9 +2
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Node HealthCheck Operator | Affected | No fix yet |
| OpenShift Pipelines | Affected | No fix yet |
| Red Hat Ceph Storage 9 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat Openshift Data Foundation 4 | Affected | No fix yet |
| Self-service automation portal 2 | Affected | — |
| Cluster Observability Operator 1.5 | Fixed | RHSA-2026:74609 |
| Migration Toolkit for Virtualization 2.10 | Fixed | RHSA-2026:83663 |
| Migration Toolkit for Virtualization 2.11 | Fixed | RHSA-2026:83662 |
| Red Hat OpenShift AI 3.4 | Fixed | RHSA-2026:84734 |
| Red Hat OpenShift Container Platform 4.14 | Fixed | RHSA-2026:89839 |
| Red Hat OpenShift Container Platform 4.16 | Fixed | RHSA-2026:89715 |
| Red Hat OpenShift Dev Spaces 3.30 | Fixed | RHSA-2026:68754 |
| Red Hat OpenShift Dev Spaces 3.31 | Fixed | RHSA-2026:90321 |
Not affected: 14 products
- Cluster Observability Operator 1.5
- Migration Toolkit for Virtualization 2.10
- Migration Toolkit for Virtualization 2.11
- Red Hat Build of Podman Desktop
- Red Hat Developer Hub 1
- Red Hat Hardened Images
- Red Hat OpenShift AI 3.4
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Container Platform 4.14
- Red Hat OpenShift Container Platform 4.16
- Red Hat OpenShift Container Platform 5
- Red Hat OpenShift Dev Spaces 3.30
- Red Hat OpenShift Dev Spaces 3.31
- Red Hat OpenShift Virtualization 4
Timeline
- 2026-10-02 Threatist record created from CVE-2026-59887
- 2026-10-03 Alias added: GHSA-v245-v573-v5vm
- 2026-10-16 Fix available: RHSA-2026:83662 · Red Hat
- 2026-10-16 Fix available: RHSA-2026:83663 · Red Hat
- 2026-10-16 Fix available: Migration Toolkit for Virtualization 2.10, Migration Toolkit for Virtualization 2.11 · Red Hat
- 2026-10-20 Fix available: RHSA-2026:84734 · Red Hat
- 2026-10-20 Fix available: Red Hat OpenShift AI 3.4 · Red Hat
- 2026-10-21 EPSS moved to the 50th–90th percentile
- 2026-10-23 Affected versions changed · Red Hat
- 2026-10-27 Affected versions changed · Red Hat
- 2026-10-29 Fix available: Red Hat OpenShift Container Platform 4.14, Red Hat OpenShift Container Platform 4.16, Red Hat OpenShift Dev Spaces 3.31 · Red Hat
- 2026-10-30 Fix available: RHSA-2026:89839 · Red Hat
- 2026-10-30 Fix available: RHSA-2026:90321 · Red Hat
- 2026-10-30 Fix available: RHSA-2026:89715 · Red Hat
- 2026-10-30 Affected versions changed · Red Hat
- 2026-10-31 EPSS moved to the below the 50th percentile
- 2026-11-05 Fix available: Cluster Observability Operator 1.5 · Red Hat
References
More markdown-it Linkify-it vulnerabilities
- TI-2026-36071 linkify-it: Quadratic algorithmic complexity in LinkifyIt#match scan loop CVSS 4.0HIGH 8.7
Sources
- CVE-2026-59887 · CVE Program
- CVE-2026-59887 · NVD
- FIRST EPSS
- GHSA-v245-v573-v5vm · GitHub Advisory Database · CC BY 4.0
- CVE-2026-59887 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences