Skip to content
Fencer Intel
high 7.5

CVE-2026-48801 json

linkify-it: Quadratic algorithmic complexity in LinkifyIt#match scan loop

published 5mo ago modified 18d ago also EUVD-2026-44454 , GHSA-22p9-wv53-3rq4

cvss
7.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 34%
public exploits
0
none known

Summary

linkify-it is a links recognition library with full Unicode support. Prior to 5.0.1, LinkifyIt.prototype.match, the package's primary public API, has O(N²) algorithmic complexity for inputs containing many fuzzy links or emails because the JavaScript-level scan loop re-slices input and re-runs unanchored regex searches on progressively shorter tails. Any service that synchronously renders untrusted Markdown with linkify:true on a request hot path can inherit a worker-process denial of service triggerable by a tens-of-KB request body. This issue is fixed in version 5.0.1.

Patch / fix

  • npm linkify-it 5.0.1
  • markdown-it linkify-it 5.0.1
  • rh-podman-desktop RHEL 10.2 1.1.2-1.el10_2
  • rust hummingbird 1 1.97.0-1.1.hum1
  • cargo hummingbird 1 1.97.0-1.1.hum1
  • clippy hummingbird 1 1.97.0-1.1.hum1
  • rustfmt hummingbird 1 1.97.0-1.1.hum1
  • rust-gdb hummingbird 1 1.97.0-1.1.hum1
  • rust-src hummingbird 1 1.97.0-1.1.hum1
  • rust-lldb hummingbird 1 1.97.0-1.1.hum1

red hat advisories RHSA-2026:57590RHSA-2026:38187

Is CVE-2026-48801 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-48801 updated cvss 7.5

linkify-it: linkify-it: Denial of Service via algorithmic complexity vulnerability

  • Red Hat Migration Toolkit for Virtualization mtv-candidate/mtv-console-plugin-rhel9, migration-toolkit-virtualization/mtv-console-plugin-rhel9
    affected: no fix available, no fix planned “Will not fix”
  • Red Hat Node HealthCheck Operator workload-availability/node-remediation-console-rhel8, workload-availability/node-remediation-console-rhel9, workload-availability/node-healthcheck-rhel9-operator, workload-availability/node-healthcheck-operator-bundle, workload-availability/node-healthcheck-must-gather-rhel9 Red Hat OpenShift Pipelines openshift-pipelines/pipelines-console-plugin-rhel8, openshift-pipelines/pipelines-console-plugin-rhel9, openshift-pipelines/pipelines-console-plugin-pf5-rhel9 Red Hat Build of Podman Desktop rh-podman-desktop.git Red Hat OpenShift Container Platform 5 openshift5/ose-console-rhel9, openshift5/ose-monitoring-plugin-rhel9, openshift5/ose-networking-console-plugin-rhel9
    affected: no fix available
  • Red Hat Ansible Automation Platform 2.1 ansible-automation-platform/automation-portal 1785854226
    fixed: vendor fix RHSA-2026:50850
  • Red Hat Ansible Automation Platform 2.2 ansible-automation-platform/automation-portal 1784622951, ansible-automation-platform/bootc-automation-portal-rhel9 1786006573
    fixed: vendor fix RHSA-2026:42815
  • Red Hat Developer Hub 1.10 rhdh/rhdh-hub-rhel9 1785411652, rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend 1785332825, rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki 1785332668, rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator 1785332694
    fixed: vendor fix RHSA-2026:48126
  • Red Hat Enterprise Linux Extensions Channel (v. 10) rh-podman-desktop 1.1.2-1.el10_2
    fixed: vendor fix RHSA-2026:57590
  • Red Hat Hardened Images rust 1.97.0-1.1.hum1, cargo 1.97.0-1.1.hum1, clippy 1.97.0-1.1.hum1, rustfmt 1.97.0-1.1.hum1, rust-gdb 1.97.0-1.1.hum1, rust-src 1.97.0-1.1.hum1, +11 more
    fixed: vendor fix RHSA-2026:38187
  • Red Hat OpenShift AI 3.4 rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9 1787121387
    fixed: vendor fix RHSA-2026:60520
show 15 more
  • Red Hat OpenShift Container Platform 4.16 openshift4/ose-networking-console-plugin-rhel9 1789458004
    fixed: vendor fix RHSA-2026:67936
  • Red Hat OpenShift Container Platform 4.17 openshift4/ose-networking-console-plugin-rhel9 1789959412
    fixed: vendor fix RHSA-2026:70587
  • Red Hat OpenShift Container Platform 4.18 openshift4/ose-monitoring-plugin-rhel9 1789906578, openshift4/ose-networking-console-plugin-rhel9 1789906839
    fixed: vendor fix RHSA-2026:70617
  • Red Hat OpenShift Container Platform 4.19 openshift4/ose-console-rhel9 1788573287, openshift4/ose-monitoring-plugin-rhel9 1788318661, openshift4/ose-networking-console-plugin-rhel9 1788587831
    fixed: vendor fix RHSA-2026:66371
  • Red Hat OpenShift Container Platform 4.20 openshift4/ose-console-rhel9 1787737695, openshift4/ose-monitoring-plugin-rhel9 1787736396, openshift4/ose-networking-console-plugin-rhel9 1789009167
    fixed: vendor fix RHSA-2026:60446
  • Red Hat OpenShift Container Platform 4.21 openshift4/ose-console-rhel9 1787590523, openshift4/ose-monitoring-plugin-rhel9 1787590390, openshift4/ose-networking-console-plugin-rhel9 1788928679
    fixed: vendor fix RHSA-2026:60477
  • Red Hat OpenShift Container Platform 4.22 openshift4/ose-console-rhel9 1785910938, openshift4/ose-monitoring-plugin-rhel9 1787730804, openshift4/ose-networking-console-plugin-rhel9 1787745534
    fixed: vendor fix RHSA-2026:51038
  • Red Hat Openshift Data Foundation 4.18 odf4/cephcsi-rhel9 1786705347, odf4/odf-cli-rhel9 1786705938, odf4/mcg-core-rhel9 1786705558, odf4/odf-console-rhel9 1786706577, odf4/mcg-rhel9-operator 1786705646, odf4/ocs-rhel9-operator 1786705802, +13 more
    fixed: vendor fix RHSA-2026:56431
  • Red Hat OpenShift Dev Spaces 3.30 devspaces/code-rhel9 1789145741, devspaces/openvsx-rhel9 1789144269, devspaces/pluginregistry-rhel9 1788883179
    fixed: vendor fix RHSA-2026:68754
  • Red Hat Developer Hub 1.10 rhdh/rhdh-rhel9-operator 1785411290, rhdh/rhdh-operator-bundle 1785415596, rhdh/rhdh-must-gather-rhel9 1784202439, rhdh/rhdh-rag-content-rhel9 1785162496, rhdh/red-hat-developer-hub-backstage-plugin-lightspeed 1785333413, rhdh/red-hat-developer-hub-backstage-plugin-orchestrator 1785340831, +2 more
    not affected: vulnerable code not present
  • Red Hat Hardened Images libgit2 1.9.4-2.hum1
    not affected: component not present
  • Red Hat OpenShift AI 3.4 rhoai/odh-cli-rhel9 1787330837, rhoai/rhai-cli-rhel9 1787330837, rhoai/odh-automl-rhel9 1786612415, rhoai/odh-mlflow-rhel9 1787226790, rhoai/odh-autorag-rhel9 1786612637, rhoai/odh-trainer-rhel9 1787089049, +99 more
    not affected: vulnerable code not present
  • Red Hat OpenShift Container Platform 4 openshift4/ose-console, openshift4/ose-monitoring-plugin-rhel8
    not affected: vulnerable code not in execute path
  • Red Hat OpenShift Container Platform 4.16 openshift4/ose-cli-rhel9 1789361923, openshift4/ose-pod-rhel9 1789370561, openshift4/ose-sdn-rhel9 1789376367, openshift4/ose-etcd-rhel9 1789369183, openshift4/ose-tests-rhel9 1789368515, openshift4/ose-tools-rhel9 1789366012, +182 more Red Hat OpenShift Container Platform 4.17 openshift4/frr-rhel9 1789938330, openshift4/ose-cli-rhel9 1789937904, openshift4/ose-pod-rhel9 1789937463, openshift4/ose-etcd-rhel9 1789937632, openshift4/ose-tests-rhel9 1790075131, openshift4/ose-tools-rhel9 1790073665, +180 more Red Hat OpenShift Container Platform 4.18 openshift4/frr-rhel9 1789904437, openshift4/ose-cli-rhel9 1789904386, openshift4/ose-pod-rhel9 1789906731, openshift4/ose-etcd-rhel9 1789906675, openshift4/ose-tests-rhel9 1790074104, openshift4/ose-tools-rhel9 1790072642, +179 more Red Hat OpenShift Container Platform 4.19 openshift4/frr-rhel9 1788311982, openshift4/frr-rhel9 1788884480, openshift4/ose-cli-rhel9 1788311429, openshift4/ose-cli-rhel9 1788566232, openshift4/ose-pod-rhel9 1788311898, openshift4/ose-pod-rhel9 1788571150, +365 more Red Hat OpenShift Container Platform 4.20 openshift4/frr-rhel9 1787736001, openshift4/frr-rhel9 1788947245, openshift4/ose-cli-rhel9 1787735982, openshift4/ose-cli-rhel9 1788948079, openshift4/ose-pod-rhel9 1787736197, openshift4/ose-pod-rhel9 1788948309, +371 more Red Hat OpenShift Container Platform 4.21 openshift4/frr-rhel9 1787555870, openshift4/frr-rhel9 1788928525, openshift4/ose-cli-rhel9 1787556246, openshift4/ose-cli-rhel9 1788928632, openshift4/ose-pod-rhel9 1787558631, openshift4/ose-pod-rhel9 1788929363, +367 more
    +3 more products
    Red Hat OpenShift Container Platform 4.22 openshift4/frr-rhel9 1785883609, openshift4/frr-rhel9 1787570998, openshift4/ose-cli-rhel9 1785883865, openshift4/ose-cli-rhel9 1787572868, openshift4/ose-pod-rhel9 1785885460, openshift4/ose-pod-rhel9 1787573725, +369 more Red Hat Openshift Data Foundation 4.18 odf4/mcg-operator-bundle 1786708633, odf4/ocs-operator-bundle 1786708778, odf4/odf-operator-bundle 1786709119, odf4/cephcsi-operator-bundle 1786708508, odf4/odr-hub-operator-bundle 1786709184, odf4/rook-ceph-operator-bundle 1786709254, +7 more Red Hat OpenShift Dev Spaces 3.30 devspaces/server-rhel9 1789163798, devspaces/traefik-rhel9 1788882066, devspaces/udi-base-rhel9 1788883444, devspaces/code-sshd-rhel9 1789144422, devspaces/dashboard-rhel9 1789162884, devspaces/configbump-rhel9 1789143601, +6 more
    not affected: vulnerable code not present
  • Red Hat OpenShift Virtualization 4 container-native-virtualization/kubevirt-console-plugin-rhel9
    not affected: vulnerable code not in execute path

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
partial
Assessed
3mo ago

Exploit prediction

0.39% chance of exploitation in the next 30 days, higher than 34% of all scored CVEs (FIRST EPSS, 2026-11-11).

Exploits and checks

  • github.com https://github.com/markdown-it/linkify-it/security/advisories/GHSA-22p9-wv53-3rq4 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 4.0 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CNA 4.0 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
npm linkify-it
<5.0.1
5.0.1

Affected products

  • markdown-it linkify-it

Classification

Weakness
  • CWE-1333 Inefficient Regular Expression Complexity

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

The maintainers of markdown-it/linkify-it published their own advisory on GitHub. Reviewed sources take precedence over it.