{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/vendors/linkify-it/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-59887"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["linkify-it \u003c= 5.0.1","markdown-it 14.x"],"_cs_severities":["low"],"_cs_tags":["denial-of-service","nodejs","web-application","vulnerability","redos"],"_cs_type":"advisory","_cs_vendors":["linkify-it"],"content_html":"\u003cp\u003eA high-severity quadratic-complexity Denial of Service (DoS) vulnerability, tracked as CVE-2026-59887, has been identified in the \u003ccode\u003elinkify-it\u003c/code\u003e JavaScript library, affecting all versions up to and including 5.0.1. This flaw stems from an inefficient regular expression used within the \u003ccode\u003emailto:\u003c/code\u003e schema validator and an O(n) string copy operation, leading to O(n²) processing time when handling malicious input. Attackers can exploit this by crafting input text containing a large number of repeated \u0026quot;mailto:\u0026quot; strings, causing applications that use \u003ccode\u003elinkify-it\u003c/code\u003e (such as \u003ccode\u003emarkdown-it\u003c/code\u003e 14.x for rendering user content) to experience significant delays and potentially block their single-threaded event loops for several seconds to tens of seconds. This unauthenticated attack vector impacts the availability of web applications like comment systems, chat platforms, forums, wikis, and note applications that process arbitrary user-supplied markdown.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn unauthenticated attacker crafts a malicious string containing numerous repetitions of \u0026quot;mailto:\u0026quot;, for example, \u0026quot;mailto:mailto:mailto:...\u0026quot;.\u003c/li\u003e\n\u003cli\u003eThe attacker submits this specially crafted text to an application that uses \u003ccode\u003elinkify-it\u003c/code\u003e (e.g., via a comment system, forum post, or chat message) to process and render user content, such as \u003ccode\u003emarkdown-it\u003c/code\u003e with linkification enabled.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003elinkify-it\u003c/code\u003e library begins scanning the input text through its schema-scan loop to identify potential links.\u003c/li\u003e\n\u003cli\u003eUpon encountering each instance of \u0026quot;mailto:\u0026quot;, the library invokes its \u003ccode\u003emailto:\u003c/code\u003e schema validator.\u003c/li\u003e\n\u003cli\u003eInside the validator function, a substring operation \u003ccode\u003etext.slice(pos)\u003c/code\u003e creates an O(n) copy of the entire remaining tail of the input string for each \u0026quot;mailto:\u0026quot; occurrence.\u003c/li\u003e\n\u003cli\u003eSubsequently, a greedy regular expression \u003ccode\u003eself.re.mailto.test(tail)\u003c/code\u003e attempts to match against this copied O(n) tail.\u003c/li\u003e\n\u003cli\u003eDue to the regex's character class \u003ccode\u003esrc_email_name\u003c/code\u003e broadly matching common characters (including those in \u0026quot;mailto:\u0026quot;) and the lack of an \u003ccode\u003e@\u003c/code\u003e symbol in the crafted string, the regex engine greedily scans the entire O(n) tail before failing.\u003c/li\u003e\n\u003cli\u003eWith N occurrences of \u0026quot;mailto:\u0026quot; in the input, the combined O(n) copy and O(n) regex scan for each occurrence results in a total processing time complexity of N × O(n) = O(n²), blocking the application's event loop and causing a denial of service.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThis vulnerability directly impacts the availability of web applications and services that rely on \u003ccode\u003elinkify-it\u003c/code\u003e to process and render user-supplied text, particularly markdown-based content. Affected systems include comment systems, chat applications, forums, wikis, and note-taking platforms. Successful exploitation can lead to a significant degradation of service, as processing a relatively small input (e.g., 220 KB) can block the application's single-threaded event loop for approximately 5 seconds, with larger inputs causing tens of seconds of unresponsiveness. The primary consequence is service unavailability, severely hindering user interaction and business operations for affected platforms.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate \u003ccode\u003elinkify-it\u003c/code\u003e to a patched version immediately to remediate CVE-2026-59887, which addresses the quadratic complexity issue.\u003c/li\u003e\n\u003cli\u003eMonitor Node.js application processes for unusual CPU spikes or prolonged execution times, as this could indicate an attempted or successful DoS attack, even without specific Sigma rules for this particular vulnerability.\u003c/li\u003e\n\u003cli\u003eImplement input validation or length restrictions on user-supplied text fields that are processed by \u003ccode\u003elinkify-it\u003c/code\u003e to mitigate the impact of excessively long strings containing repeated \u003ccode\u003emailto:\u003c/code\u003e patterns.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-21T19:08:30Z","date_published":"2026-07-21T19:08:30Z","id":"https://feed.craftedsignal.io/briefs/2026-07-linkify-it-dos/","summary":"The JavaScript library linkify-it is vulnerable to a quadratic-complexity Denial of Service (DoS) (CVE-2026-59887) due to an inefficient regular expression in its `mailto:` schema validator, which allows an unauthenticated attacker to block application event loops by supplying specially crafted input with repeated 'mailto:' strings.","title":"Linkify-it Denial of Service via Mailto Validator Quadratic Complexity","url":"https://feed.craftedsignal.io/briefs/2026-07-linkify-it-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - Linkify-It","version":"https://jsonfeed.org/version/1.1"}