linkify‑it contains a mailto: schema validator that, when invoked on each mailto: occurrence, scans the remaining input with the src_email_name function, producing an O(n²) CPU consumption pattern. This inefficiency can be triggered by specially crafted user text, leading to high CPU usage and eventually causing the process that uses linkify‑it to become unresponsive or crash. This flaw corresponds to CWE-407, an inefficient algorithm that results in quadratic time complexity.

The vulnerability exists in linkify‑it versions earlier than 5.0.2. Applications that bundle linkify‑it as part of markdown-it or other markdown processors, such as web frameworks or content‑management systems that accept user‑supplied markdown, are at risk if they have not upgraded to a fixed version.

The CVSS score of 7.5 signals high severity, while the EPSS score of less than 1% indicates a very low but non‑zero probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit this by supplying heavily crafted text containing many mailto: links to any application that processes that text with() or .match() methods. Because the attack merely requires uncontrolled input, it can be executed remotely without privileged access and can exhaust server resources, resulting in a denial of service.