markdown-it linkify-it up to 5.0.0 Link Recognition lib/LinkifyIt.js match input resource consumption

Summaryinfo

A vulnerability, which was classified as problematic, has been found in markdown-it linkify-it up to 5.0.0. This issue affects the function Match of the file lib/LinkifyIt.js of the component Link Recognition. The manipulation of the argument input leads to resource consumption. This vulnerability is listed as CVE-2026-48801. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in markdown-it linkify-it up to 5.0.0. This issue affects the function match of the file lib/LinkifyIt.js of the component Link Recognition. The manipulation of the argument input with an unknown input leads to a resource consumption vulnerability. Using CWE to declare the problem leads to CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. Impacted is availability. The summary by CVE is:

linkify-it is a links recognition library with full Unicode support. Prior to 5.0.1, LinkifyIt.prototype.match, the package's primary public API, has O(N²) algorithmic complexity for inputs containing many fuzzy links or emails because the JavaScript-level scan loop re-slices input and re-runs unanchored regex searches on progressively shorter tails. Any service that synchronously renders untrusted Markdown with linkify:true on a request hot path can inherit a worker-process denial of service triggerable by a tens-of-KB request body. This issue is fixed in version 5.0.1.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-48801 since 05/22/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1499 according to MITRE ATT&CK.

Upgrading to version 5.0.1 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at CERT Bund (WID-SEC-2026-2923). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Affected

• Atlassian Bamboo
• Atlassian Bitbucket
• Atlassian Confluence
• Atlassian Crucible
• Atlassian Fisheye
• Atlassian Jira

Productinfo

Vendor

• markdown-it

Name

• linkify-it

Version

• 5.0

Website

• Product: https://github.com/markdown-it/linkify-it/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion