linkify-it vulnerabilities

2 known vulnerabilities in linkify-it from Markdown-it. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  linkify-it: Inefficient Regular Expression Complexity

  CVE-2026-48801Jul 14, 2026Markdown-it

  linkify-it is a links recognition library with full Unicode support. Prior to 5.0.1, LinkifyIt.prototype.match, the package's primary public API, has O(N²) algorithmic complexity for inputs containing many fuzzy links or emails because the JavaScript-level sca

• 7.5 High severity

  linkify-it: Inefficient Algorithmic Complexity

  CVE-2026-59887Jul 8, 2026Markdown-it

  linkify-it is a links recognition library with full Unicode support. Prior to 5.0.2, the mailto: schema validator used by .test() and .match() can be invoked at every mailto: occurrence and scan the remaining input through src_email_name in lib/re.mjs, causing