Linkify It
Approved changes feed: RSS · Atom
cpe:2.3:a:markdown-it:linkify-it:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Markdown It (bdbcfa93-9d16-536c-9aae-f65ace6bb9e5) |
|---|---|
| Product | Linkify It (1af501b8-8d44-580e-b582-96333d15acd7) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/markdown-it/linkify-it |
purl2cpe | 2026-08-13 06:19:43.761304 |
pkg:npm/linkify-it |
purl2cpe | 2026-08-13 06:19:43.761307 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-59887 |
vulnerable | 2026-07-29 01:03:18.041991 |
linkify-it: Quadratic-complexity DoS via the `mailto:` validator scan-loop on attacker text
HIGH (7.5)
linkify-it is a links recognition library with full Unicode support. Prior to 5.0.2, the mailto: schema validator used by .test() and .match() can be invoked at every mailto: occurrence and scan the remaining input through src_email_name in lib/re.mjs, causing O(n^2) CPU consumption on crafted user text. This issue is fixed in version 5.0.2.
Published: 2026-07-08T15:58:12.114Z
Updated: 2026-07-09T14:41:02.113Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-48801 |
vulnerable | 2026-07-29 00:55:01.663345 |
linkify-it: Quadratic algorithmic complexity in LinkifyIt#match scan loop
linkify-it is a links recognition library with full Unicode support. Prior to 5.0.1, LinkifyIt.prototype.match, the package's primary public API, has O(N²) algorithmic complexity for inputs containing many fuzzy links or emails because the JavaScript-level scan loop re-slices input and re-runs unanchored regex searches on progressively shorter tails. Any service that synchronously renders untrusted Markdown with linkify:true on a request hot path can inherit a worker-process denial of service triggerable by a tens-of-KB request body. This issue is fixed in version 5.0.1.
Published: 2026-07-14T20:03:56.430Z
Updated: 2026-07-15T12:56:15.250Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.