{"id":"GHSA-v245-v573-v5vm","summary":"linkify-it: Quadratic-complexity DoS via the `mailto:` validator scan-loop on attacker text","details":"### Summary\n`linkify-it`'s schema-scan loop (`.test()` / `.match()`, the documented public API) invokes the `mailto:`\nschema validator at **every** `mailto:` occurrence in the input text. For each occurrence the validator does\n`text.slice(pos)` (an O(n) copy) and runs an email regex whose local-part class `src_email_name` greedily\nscans the **entire remaining tail** (O(n)) before failing. With N `mailto:` occurrences that is\n**N × O(n) = O(n²)**. Because linkify-it runs on arbitrary user text (markdown-it feeds it whole documents\nwhen `linkify:true`), an unauthenticated attacker can block the single-threaded event loop for many seconds\nwith a small input. No length bound (unlike an HTTP header).\n\n### Root cause — `index.mjs` + `lib/re.mjs`\n```js\n// index.mjs (mailto validator) — runs at every \"mailto:\" hit\n'mailto:': { validate: function (text, pos, self) {\n  const tail = text.slice(pos)                                  // O(n) copy per hit\n  if (!self.re.mailto) self.re.mailto = new RegExp('^' + self.re.src_email_name + '@' + self.re.src_host_strict, 'i')\n  if (self.re.mailto.test(tail)) { ... }                        // scans the whole O(n) tail\n  return 0\n}}\n// lib/re.mjs:91-93 — every char of \"mailto:\" (incl. ':','-',';') is in this class:\nre.src_email_name = '[\\\\-;:&=\\\\+\\\\$,\\\\.a-zA-Z0-9_][\\\\-;:&=\\\\+\\\\$,\\\\\"\\\\.a-zA-Z0-9_]*'\n```\nThe `while ((m = re.exec(text)) !== null) { …testSchemaAt… }` scan loop calls the validator at each\n`mailto:` hit; `src_email_name` greedily consumes the whole tail (all chars are in its class) then fails for\nlack of `@`. `http:`/`https:` do NOT blow up — their validator requires the tail to start with `//`, failing\nin O(1) per hit.\n\n### Proof of Concept (confirmed, linkify-it 5.0.1, Node v24)\n```js\nconst LinkifyIt = require('linkify-it');\nconst lf = new LinkifyIt();\nlf.match('mailto:'.repeat(48000));   // ~336 KB of \"mailto:mailto:…\" -\u003e seconds of blocked event loop\n```\n| input (same bytes) | 56 KB | 112 KB | 224 KB | 336 KB |\n|---|---:|---:|---:|---:|\n| **`mailto:` contiguous** | 97 ms | 357 ms | 1438 ms | 3272 ms |\n| `mailto:` space-separated | 2 ms | 3 ms | 5 ms | 8 ms |\n| `http://` contiguous | 12 ms | 17 ms | 33 ms | 49 ms |\n\n×~4 per 2× input ⇒ O(n²); equal-byte controls stay flat ⇒ algorithmic, not a GC/allocation artifact.\nReal-world via markdown-it 14.x (`{linkify:true}`), `md.render('mailto:'.repeat(n))`: 219 KB ≈ ~5 s.\n\u003cimg width=\"737\" height=\"161\" alt=\"image\" src=\"https://github.com/user-attachments/assets/b5d390f3-68d0-4861-9c47-ad8aff0203d5\" /\u003e\n\n### Impact\nReachable on arbitrary user text via the documented `.test()`/`.match()` API and through markdown-it's\nlinkifier — comment systems, chat, forums, wikis, note apps that render user markdown with linkify enabled.\nA ~220 KB post hangs the event loop ~5 s; a few hundred KB → tens of seconds. Availability only.\n\n### Suggested remediation\nBound the email local-part per RFC 5321 (≤64) so per-hit work is O(1), and avoid the full-tail slice:\n```js\n// lib/re.mjs — cap the greedy run:\nre.src_email_name = '[\\\\-;:&=\\\\+\\\\$,\\\\.a-zA-Z0-9_][\\\\-;:&=\\\\+\\\\$,\\\\\"\\\\.a-zA-Z0-9_]{0,63}'\n// index.mjs — prefer a sticky regex anchored at `pos` over text.slice(pos).\n```\n\n### Affected / disclosure\nAll versions through 5.0.1 (latest); same code on `master`. cve-mcp/OSV report no known vulnerability for\nlinkify-it. Distinct from markdown-it's own `*`-run ReDoS (CVE-2026-2327, different package/path) and the\nrecent markdown-it DoS. Reported privately; happy to test a patch against the PoC.","aliases":["CVE-2026-59887"],"modified":"2026-09-10T03:51:12.054179363Z","published":"2026-07-21T19:06:09Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2026-07-21T19:06:09Z","nvd_published_at":"2026-07-08T17:17:26Z","cwe_ids":["CWE-407"],"severity":"HIGH"},"references":[{"type":"WEB","url":"https://github.com/markdown-it/linkify-it/security/advisories/GHSA-v245-v573-v5vm"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59887"},{"type":"WEB","url":"https://github.com/markdown-it/linkify-it/commit/105e5d77f7d119871d2b2d86ed208568eb3e7ffe"},{"type":"PACKAGE","url":"https://github.com/markdown-it/linkify-it"},{"type":"WEB","url":"https://github.com/markdown-it/linkify-it/releases/tag/5.0.2"}],"affected":[{"package":{"name":"linkify-it","ecosystem":"npm","purl":"pkg:npm/linkify-it"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.0.2"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-v245-v573-v5vm/GHSA-v245-v573-v5vm.json","last_known_affected_version_range":"\u003c= 5.0.1"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}