CVE-2026-48801: linkify-it DoS Vulnerability

CVE-2026-48801 Overview

CVE-2026-48801 is an algorithmic complexity vulnerability in the linkify-it JavaScript library, a links recognition package with full Unicode support. Versions prior to 5.0.1 expose LinkifyIt.prototype.match to O(N²) worst-case behavior when parsing input containing many fuzzy links or email patterns. The scan loop re-slices input and re-runs unanchored regex searches on progressively shorter tails, amplifying processing time as input grows. Any service that synchronously renders untrusted Markdown with linkify:true on a request hot path can suffer a worker-process denial of service. An attacker only needs to submit a request body of tens of kilobytes to trigger the condition. The issue is classified under [CWE-1333] (Inefficient Regular Expression Complexity) and is fixed in linkify-it version 5.0.1.

Critical Impact
A remote, unauthenticated attacker can exhaust worker processes by submitting crafted Markdown containing dense fuzzy link or email tokens, causing denial of service on affected rendering services.

Affected Products

linkify-it versions prior to 5.0.1
Applications embedding markdown-it with linkify:true on request paths
Downstream services synchronously rendering untrusted Markdown containing user-supplied content

Discovery Timeline

2026-07-14 - CVE-2026-48801 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-48801

Vulnerability Analysis

The linkify-it library scans text to identify URLs, email addresses, and fuzzy link candidates that lack explicit schemes. The primary public API, LinkifyIt.prototype.match, iterates over the input string looking for potential link starts. For each candidate, the scanner re-slices the remaining input and applies unanchored regular expressions to the shorter tail. As the number of fuzzy link or email tokens grows, the total work performed scales quadratically relative to input length.

Applications that use markdown-it with the linkify:true option pass user-supplied Markdown directly through this matcher. A tens-of-KB payload densely populated with fuzzy link or email-like tokens forces the Node.js event loop to block on repeated regex evaluation. Because rendering typically executes on the request hot path, a single request can consume an entire worker process for seconds or longer. Repeated requests exhaust the worker pool and produce a service-wide denial of service.

Root Cause

The root cause is inefficient algorithmic design in the JavaScript-level scan loop rather than catastrophic backtracking in a single regex. Re-slicing the input string and repeatedly invoking unanchored regex searches on progressively shorter suffixes produces O(N²) complexity. The library did not enforce bounds on token density or the number of match attempts per input.

Attack Vector

Exploitation requires no authentication and no user interaction beyond submitting content to an endpoint that renders Markdown with linkification enabled. Comment forms, chat messages, wiki edits, issue trackers, and webhook receivers are common attack surfaces. The attacker crafts a payload consisting of many fuzzy link fragments or email-like strings and submits it in a normal HTTP request body. Refer to the GitHub Security Advisory GHSA-22p9-wv53-3rq4 for technical details on the payload structure and remediation.

Detection Methods for CVE-2026-48801

Indicators of Compromise

Sustained CPU saturation on Node.js worker processes correlated with inbound HTTP requests containing large Markdown bodies
Request timeouts or 5xx responses from endpoints that render user-supplied Markdown
Elevated event loop lag metrics coinciding with requests to comment, chat, or content submission endpoints

Detection Strategies

Inventory Node.js applications for dependencies on linkify-it at versions below 5.0.1, including transitive pulls through markdown-it
Instrument Markdown rendering paths with per-request duration metrics and alert on outliers exceeding baseline by orders of magnitude
Inspect application logs for repeated requests from the same source that produce abnormally long render times

Monitoring Recommendations

Track worker process CPU time and event loop lag exposed by Node.js runtime metrics
Monitor HTTP request size distributions on endpoints accepting Markdown and alert on statistical anomalies
Correlate web application firewall telemetry with backend latency to identify low-volume DoS attempts

How to Mitigate CVE-2026-48801

Immediate Actions Required

Upgrade linkify-it to version 5.0.1 or later across all Node.js projects and lockfiles
Audit transitive dependencies by running npm ls linkify-it and forcing resolution overrides where needed
Enforce request body size limits on endpoints that render Markdown with linkification enabled

Patch Information

The fix is available in linkify-it 5.0.1. The upstream commit is published at markdown-it/linkify-it commit 6be6d15. Full remediation guidance is provided in the GitHub Security Advisory GHSA-22p9-wv53-3rq4.

Workarounds

Disable the linkify:true option in markdown-it configurations that process untrusted input until the patch is deployed
Offload Markdown rendering to an isolated worker pool with strict CPU time limits per request
Apply upstream input length caps at the reverse proxy or API gateway to reject oversized payloads before they reach the renderer

bash

# Configuration example
npm install linkify-it@^5.0.1
npm ls linkify-it