Technical impact
linkify‑it is a links recognition library with full Unicode support. The public API LinkifyIt.prototype.match has O(N²) complexity for inputs that contain many fuzzy links or email patterns, because the JavaScript‑level scan loop repeatedly slices the input and re‑runs unanchored regex searches on progressively shorter tails. When a service synchronously renders untrusted Markdown with linkify:true on a request hot path, a tens‑of‑KB payload can trigger a worker‑process denial of service. This vulnerability is classified as CWE‑1333 and was fixed in version 5.0.1.
Affected Systems
All installations of linkify‑it versions earlier than 5.0.1 that are used with markdown‑it or other Markdown rendering frameworks, when the linkify option is enabled for user supplied content, are affected. It is inferred that other Markdown rendering frameworks could also be impacted because many such frameworks may depend on linkify‑it, but the data does not explicitly state that they are affected. Any service that synchronously renders such Markdown in response to a request is potentially vulnerable.
Risk and Exploitability
The CVSS score of 8.7 indicates high severity. The EPSS score of less than 1% suggests the probability of exploitation is very low at present, and the vulnerability is not listed in CISA’s KEV catalog. Attackers only need the ability to send a Markdown payload containing many potential links or email patterns to a vulnerable endpoint that processes Markdown with linkify enabled. No special privileges or access are required beyond the ability to send the payload, making the vulnerability exploitable in many exposed services.
Github GHSA