CVE-2026-48801: 
JavaScript vulnerability analysis and mitigation

CVE-2026-48801 is a denial-of-service vulnerability in the linkify-it npm package caused by quadratic algorithmic complexity (O(N²)) in the LinkifyIt.prototype.match scan loop. All versions up to and including 5.0.0 are affected; the vulnerability has existed since the library's initial commit in 2014. It was first published by maintainer Vitaly Puzrin on May 23, 2026, and added to the GitHub Advisory Database on June 26, 2026. The CVSS v3.1 base score is 7.5 (High) and the CVSS v4.0 base score is 8.7 (High) (Github Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-1333 (Inefficient Regular Expression Complexity), but is more precisely a structural algorithmic flaw in the JavaScript-level scan loop rather than a classic regex backtracking issue. In LinkifyIt.prototype.match (index.mjs:528-554), the loop iterates O(N) times — once per matched link or email — and on each iteration calls tail.slice() (O(N) string reallocation) and then this.test(tail), which runs three unanchored regex searches (host_fuzzy_test, link_fuzzy, email_fuzzy) over the full remaining tail. The total cost is Σ(N − i·c) for i=0..N, yielding O(N²). By contrast, the schema-prefixed scan branch in the same function correctly uses a g-flag RegExp with lastIndex advancement for linear performance. A public proof-of-concept is included in the advisory: 64 KB of repeated a@b.com consumes ~2.5 seconds of single-threaded CPU on Node.js v25.5.0, and 128 KB takes ~10 seconds (Github Advisory, Patch Commit).

The sole impact is high availability loss — there is no confidentiality or integrity impact. A single HTTP request containing tens of kilobytes of repeated email-like strings (e.g., a@b.com repeated) can block one Node.js worker thread for seconds to tens of seconds. Under moderate concurrency (10–50 simultaneous requests), the entire rendering tier of an affected service can be rendered unresponsive. The vulnerability propagates transitively through markdown-it (~21.6M weekly npm downloads) when linkify: true is set, affecting platforms such as Discourse, Mattermost, GitLab CE, Open WebUI, LibreChat, and other wiki or chat applications that synchronously render untrusted Markdown on request hot paths (Github Advisory).

1. Identify target services: Locate internet-facing services that accept untrusted user-submitted text (e.g., forum posts, comments, chat messages, wiki edits) and render it using markdown-it with linkify: true, or directly call linkify-it's match() API on user input.
2. Craft the malicious payload: Generate a request body of 64–128 KB consisting of repeated email-like strings, e.g., 'a@b.com\n'.repeat(8000) (64 KB). This pattern maximizes the number of fuzzy email matches processed by the vulnerable loop.
3. Submit the payload: Send the crafted content as an HTTP POST request to any endpoint that triggers Markdown rendering or link detection (e.g., a comment submission, chat message, or document save endpoint).
4. Achieve denial of service: The server's Node.js worker thread executing LinkifyIt.prototype.match() blocks for 2.5–10+ seconds processing the O(N²) scan loop. Repeating this at moderate concurrency (10–50 requests) exhausts the worker pool and renders the service unresponsive to legitimate users (Github Advisory).

• Network: Repeated HTTP POST requests to content-submission endpoints (e.g., /comment, /post, /message, /render) with request bodies of 32–128 KB consisting predominantly of repeated email-like or URL-like patterns (e.g., a@b.com or a.com repeated hundreds or thousands of times).
• Logs: Web server or application logs showing unusually high response times (seconds to tens of seconds) for content-submission endpoints; Node.js process logs showing event loop lag or timeout warnings during Markdown rendering operations.
• Process: Node.js worker processes showing sustained near-100% single-core CPU utilization for several seconds per request; application performance monitoring (APM) traces showing linkify-it or markdown-it render calls with anomalously long durations correlated with large input sizes.

Upgrade linkify-it to version 5.0.1 or later, which rewrites the scan loop to use stateful g-flag regex iteration (O(N) complexity) instead of repeated tail-slicing (Github Advisory, Patch Commit). A Red Hat errata (RHSA-2026:42815) is also available for affected Red Hat products (Red Hat Bugzilla). As interim workarounds for services that cannot immediately upgrade: enforce strict request body size limits (e.g., reject bodies exceeding 10–16 KB for Markdown input fields); process user-supplied Markdown asynchronously in isolated worker threads or child processes with enforced CPU timeouts; or disable linkify: true in markdown-it configurations where link auto-detection is not essential.

The vulnerability was responsibly disclosed by researcher hillalee and published by maintainer Vitaly Puzrin (puzrin) on May 23, 2026, with a patch released promptly. Red Hat tracked the issue via Bugzilla (Bug 2500656) and issued an errata (RHSA-2026:42815), indicating broad downstream concern given the package's transitive reach through markdown-it. No significant independent researcher commentary or major media coverage beyond the advisory and vendor tracking has been identified (Github Advisory, Red Hat Bugzilla).