Skip to content
Threat Feed
Subscribe

Tag

Redos

2 briefs RSS
low advisory

Linkify-it Denial of Service via Mailto Validator Quadratic Complexity

The JavaScript library linkify-it is vulnerable to a quadratic-complexity Denial of Service (DoS) (CVE-2026-59887) due to an inefficient regular expression in its `mailto:` schema validator, which allows an unauthenticated attacker to block application event loops by supplying specially crafted input with repeated 'mailto:' strings.

linkify-it <= 5.0.1 +1 denial-of-service nodejs web-application vulnerability redos
1t 1c
high advisory

Picomatch ReDoS Vulnerability via Extglob Quantifiers

Picomatch is vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns with quantifiers, leading to excessive CPU consumption and denial of service.

picomatch ReDoS denial-of-service extglob
2r 1t