CyberRota Analysis
AI-GeneratedThe linkify-it library, prior to version 5.0.1, is vulnerable due to its inefficient O(N²) algorithmic complexity in processing inputs with numerous fuzzy links or emails, which can lead to denial of service (DoS) when untrusted Markdown is rendered synchronously. Services that utilize this library with the linkify:true option on high-traffic request paths should prioritize upgrading to version 5.0.1 to mitigate potential DoS attacks triggered by relatively small request bodies.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
linkify-it is a links recognition library with full Unicode support. Prior to 5.0.1, LinkifyIt.prototype.match, the package's primary public API, has O(N²) algorithmic complexity for inputs containing many fuzzy links or emails because the JavaScript-level scan loop re-slices input and re-runs unanchored regex searches on progressively shorter tails. Any service that synchronously renders untrusted Markdown with linkify:true on a request hot path can inherit a worker-process denial of service triggerable by a tens-of-KB request body. This issue is fixed in version 5.0.1.