CVE-2026-59887: linkify-it ReDoS Vulnerability in Email Validation

Technical summary

The vulnerability exists in the mailto: schema validator invoked by the .test() and .match() methods in linkify-it prior to version 5.0.2. The src_email_name regular expression in lib/re.mjs exhibits algorithmic complexity that degrades quadratically with input length (O(n²)) when processing crafted email patterns. An attacker can supply input strings with repeated or nested mailto: constructs that force the validator to re-scan large portions of the remaining input on each match attempt, leading to CPU exhaustion. This is a regular expression denial-of-service (ReDoS) vulnerability.

Business impact

Any web application or backend service that uses linkify-it to parse or validate user-generated content (comments, chat messages, forum posts, etc.) becomes susceptible to denial-of-service attacks. A malicious actor can submit input that causes processing to hang or timeout, affecting availability. In high-traffic environments or API-driven architectures, this can cascade into broader service degradation. The impact is amplified in multi-tenant systems where a single attack affects all users.

Affected systems

linkify-it versions prior to 5.0.2 are affected. Any application that imports this library as a dependency and uses it to process untrusted input is at risk. Common use cases include Markdown processors, rich text editors, content moderation pipelines, and chat/messaging platforms. The vulnerability affects both Node.js applications and browser-based JavaScript that bundles linkify-it.

Exploitability

Exploitation is straightforward and requires no special privileges or authentication. An attacker needs only to submit specially crafted text containing mailto: patterns to any endpoint that processes the input through linkify-it's .test() or .match() methods. The attack can be launched from the network without user interaction. The CVSS vector reflects this: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The primary barrier to exploitation is whether an application exposes linkify-it processing to untrusted input; if it does, the attack is trivial to execute.

Remediation

Upgrade linkify-it to version 5.0.2 or later. This release fixes the algorithmic complexity in src_email_name by optimizing the regular expression to avoid quadratic backtracking. After patching, verify that your application dependencies are properly resolved (especially if using lock files like package-lock.json or yarn.lock). For applications that cannot immediately upgrade, implement input validation or rate limiting on text processing endpoints to mitigate abuse.

Patch guidance

Update linkify-it via npm or your package manager: npm install linkify-it@^5.0.2. Verify the installed version with npm list linkify-it. If linkify-it is a transitive dependency (pulled in by another package), check that package's package.json or advisory to ensure it has been updated to a version that requires linkify-it 5.0.2+. Test your application's link detection functionality after patching to ensure no regressions. If you maintain your own bundled versions, regenerate bundles with the patched library.

Detection guidance

Monitor your application logs for patterns of slow or hanging requests that involve text processing with email-like patterns. If possible, implement request timeouts for endpoints that call linkify-it methods on user input. Search your codebase for direct calls to linkify-it.test() or linkify-it.match() to identify all code paths that could be affected. Check your dependency trees (npm ls linkify-it) to confirm which versions are installed in each environment. Use npm audit or similar tools to flag the vulnerability in your dependency reports.

Why prioritize this

This is a HIGH severity denial-of-service vulnerability that affects availability without requiring authentication or user interaction. The attack is trivial to execute if user input is processed through linkify-it. Organizations running public-facing services (web applications, APIs, chat platforms) that use linkify-it should prioritize patching within days, not weeks. If the library is used only in internal, trusted environments, the risk is lower but should still be addressed during the next maintenance window.

Risk score, explained

The CVSS 3.1 score of 7.5 reflects a network-exploitable, authentication-free denial-of-service condition with no impact to confidentiality or integrity. The score is elevated because the attack vector is unrestricted (AV:N), the attack complexity is low (AC:L), and availability impact is high (A:H). Contextually, the risk can be higher if your organization processes high volumes of user-supplied text or operates critical services dependent on linkify-it; conversely, the risk is lower if linkify-it is used only in isolated internal components or with pre-validated input.

Frequently asked questions