CVE-2026-59887: linkify-it DoS Vulnerability

CVE-2026-59887 Overview

CVE-2026-59887 is a denial-of-service vulnerability in linkify-it, a widely used JavaScript links recognition library with full Unicode support. Versions prior to 5.0.2 contain an inefficient regular expression in the mailto: schema validator invoked by .test() and .match(). The src_email_name pattern in lib/re.mjs allows an attacker to trigger O(n^2) CPU consumption using crafted user input. Each mailto: occurrence causes the scanner to rescan the remaining input, exhausting CPU resources. The issue is categorized under [CWE-407] (Inefficient Algorithmic Complexity) and is resolved in version 5.0.2.

Critical Impact
A remote unauthenticated attacker can degrade or halt applications that use linkify-it to process untrusted text by submitting specially crafted strings containing repeated mailto: patterns.

Affected Products

linkify-it versions prior to 5.0.2
Applications and frameworks embedding linkify-it for URL and email recognition
markdown-it deployments that rely on vulnerable linkify-it releases

Discovery Timeline

2026-07-08 - CVE-2026-59887 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-59887

Vulnerability Analysis

The vulnerability lives in lib/re.mjs, where the regular expression building blocks used to match email-like tokens do not bound the length of the candidate scan. When linkify-it encounters a mailto: occurrence, its validator invokes src_email_name and scans forward through the remaining input. On adversarial input containing many mailto: fragments or long unmatchable prefixes, the engine repeatedly rescans overlapping regions of the string.

This behavior yields quadratic time complexity relative to the input size. Server-side callers that pass user-controlled text to .test() or .match() block the JavaScript event loop while the regex engine runs. In Node.js services, a single request can stall the process and starve concurrent clients.

Root Cause

The root cause is an unbounded quantifier inside the auth/user-name portion of the email pattern. The original src_auth construct used ((?!ZCc|[@/\[\]()]).)+@?, which permits arbitrarily long backtracking scans. Combined with the schema validator restarting at every mailto: occurrence, the engine performs redundant work proportional to the square of the input length.

Attack Vector

Exploitation requires only the ability to submit text that will be processed by linkify-it. Common sinks include chat messages, comments, markdown rendering pipelines, and email preview features. No authentication, user interaction, or special privileges are required, and the attack traverses the network wherever the vulnerable code parses untrusted content.

text

     '(?:(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)'
 
   // Prohibit any of "@/[]()" in user/pass to avoid wrong domain fetch.
-  re.src_auth = '(?:(?:(?!' + re.src_ZCc + '|[@/\\[\\]()]).)+@)?'
+  // Length is capped to exclude possible rescans till the end and avoid O(n^2)
+  // DoS. No standard limit, just take something reasonable.
+  re.src_auth = '(?:(?:(?!' + re.src_ZCc + '|[@/\\[\\]()]).){1,50}@)?'
 
   re.src_port =

Source: GitHub Commit 105e5d7. The patch caps the auth scan to 50 characters, eliminating the unbounded backtracking path that enables the O(n^2) behavior.

Detection Methods for CVE-2026-59887

Indicators of Compromise

Sustained high CPU utilization on Node.js worker processes handling text input containing repeated mailto: substrings.
Increased request latency or event loop blocking coinciding with markdown, comment, or chat rendering.
HTTP requests carrying unusually long payloads with dense mailto: tokens or long runs of non-terminating characters preceding @.

Detection Strategies

Inventory dependencies with npm ls linkify-it and identify any transitive usage below version 5.0.2, including through markdown-it.
Enable Node.js event loop lag metrics and alert on prolonged synchronous blocking in request handlers that invoke linkify-it.
Deploy web application firewall rules to flag request bodies containing many mailto: occurrences or oversized email-like tokens.

Monitoring Recommendations

Correlate CPU spikes with request logs to attribute resource exhaustion to specific endpoints that parse user text.
Track process restarts or health-check failures on services performing markdown or link expansion.
Log the size of user-submitted text processed by .test() and .match() calls and alert on outliers.

How to Mitigate CVE-2026-59887

Immediate Actions Required

Upgrade linkify-it to version 5.0.2 or later across all direct and transitive dependencies.
Rebuild and redeploy applications and container images that ship with prior versions of the library.
Restrict the maximum length of user-supplied text passed to link recognition functions.

Patch Information

The fix is delivered in linkify-it 5.0.2 and detailed in the GHSA-v245-v573-v5vm advisory. The corrective commit caps the local scan length in src_email_name and src_auth inside lib/re.mjs, breaking the O(n^2) exploitation path.

Workarounds

Enforce input size limits at the application boundary before invoking linkify-it methods.
Offload link recognition to a worker thread with a timeout to prevent event loop starvation.
Strip or normalize mailto: substrings from untrusted input when link recognition is not required.

bash

# Upgrade linkify-it to the patched release
npm install linkify-it@^5.0.2

# Verify no vulnerable versions remain in the dependency tree
npm ls linkify-it

# Audit for known advisories
npm audit --production