CyberRota Analysis
AI-GeneratedThe linkify-it library, prior to version 5.0.2, is vulnerable to a denial-of-service attack due to an inefficient mailto: schema validator that can lead to O(n^2) CPU consumption when processing specially crafted input. This vulnerability can be exploited to degrade application performance significantly, making it a critical concern for developers and organizations utilizing this library in their projects. Users of affected versions should prioritize upgrading to version 5.0.2 or later to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
linkify-it is a links recognition library with full Unicode support. Prior to 5.0.2, the mailto: schema validator used by .test() and .match() can be invoked at every mailto: occurrence and scan the remaining input through src_email_name in lib/re.mjs, causing O(n^2) CPU consumption on crafted user text. This issue is fixed in version 5.0.2.