Skip to content
Fencer Vulns
high 7.5

CVE-2026-48801 json

linkify-it: Quadratic algorithmic complexity in LinkifyIt#match scan loop

published 2026-06-26 4 mo ago modified 2026-10-24 15 d ago also GHSA-22p9-wv53-3rq4 , EUVD-2026-44454

cvss
7.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 33%
public exploits
0
none known

Summary

linkify-it is a links recognition library with full Unicode support. Prior to 5.0.1, LinkifyIt.prototype.match, the package's primary public API, has O(N²) algorithmic complexity for inputs containing many fuzzy links or emails because the JavaScript-level scan loop re-slices input and re-runs unanchored regex searches on progressively shorter tails. Any service that synchronously renders untrusted Markdown with linkify:true on a request hot path can inherit a worker-process denial of service triggerable by a tens-of-KB request body. This issue is fixed in version 5.0.1.

Patch / fix

  • npm linkify-it 5.0.1
  • markdown-it linkify-it 5.0.1
  • rh-podman-desktop RHEL 10.2 1.1.2-1.el10_2
  • rust hummingbird 1 1.97.0-1.1.hum1
  • cargo hummingbird 1 1.97.0-1.1.hum1
  • clippy hummingbird 1 1.97.0-1.1.hum1
  • rustfmt hummingbird 1 1.97.0-1.1.hum1
  • rust-gdb hummingbird 1 1.97.0-1.1.hum1
  • rust-src hummingbird 1 1.97.0-1.1.hum1
  • rust-lldb hummingbird 1 1.97.0-1.1.hum1

red hat advisories RHSA-2026:57590RHSA-2026:38187

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-48801 updated cvss 7.5

linkify-it: linkify-it: Denial of Service via algorithmic complexity vulnerability

  • Red Hat Migration Toolkit for Virtualization mtv-candidate/mtv-console-plugin-rhel9, migration-toolkit-virtualization/mtv-console-plugin-rhel9
    affected: no fix available, no fix planned “Will not fix”
  • Red Hat Node HealthCheck Operator workload-availability/node-remediation-console-rhel8, workload-availability/node-remediation-console-rhel9, workload-availability/node-healthcheck-rhel9-operator, workload-availability/node-healthcheck-operator-bundle, workload-availability/node-healthcheck-must-gather-rhel9 Red Hat OpenShift Pipelines openshift-pipelines/pipelines-console-plugin-rhel8, openshift-pipelines/pipelines-console-plugin-rhel9, openshift-pipelines/pipelines-console-plugin-pf5-rhel9 Red Hat Build of Podman Desktop rh-podman-desktop.git Red Hat OpenShift Container Platform 4 openshift4/ose-monitoring-plugin-rhel8 Red Hat OpenShift Container Platform 5 openshift5/ose-console-rhel9, openshift5/ose-monitoring-plugin-rhel9, openshift5/ose-networking-console-plugin-rhel9
    affected: no fix available
  • Red Hat Ansible Automation Platform 2.1 ansible-automation-platform/automation-portal 1785854226
    fixed: vendor fix RHSA-2026:50850
  • Red Hat Ansible Automation Platform 2.2 ansible-automation-platform/automation-portal 1784622951, ansible-automation-platform/bootc-automation-portal-rhel9 1786006573
    fixed: vendor fix RHSA-2026:42815
  • Red Hat Developer Hub 1.10 rhdh/rhdh-hub-rhel9 1785411652, rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend 1785332825, rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki 1785332668, rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator 1785332694
    fixed: vendor fix RHSA-2026:48126
  • Red Hat Enterprise Linux Extensions Channel (v. 10) rh-podman-desktop 1.1.2-1.el10_2
    fixed: vendor fix RHSA-2026:57590
  • Red Hat Hardened Images rust 1.97.0-1.1.hum1, cargo 1.97.0-1.1.hum1, clippy 1.97.0-1.1.hum1, rustfmt 1.97.0-1.1.hum1, rust-gdb 1.97.0-1.1.hum1, rust-src 1.97.0-1.1.hum1, +11 more
    fixed: vendor fix RHSA-2026:38187
  • Red Hat OpenShift AI 3.4 rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9 1787121387
    fixed: vendor fix RHSA-2026:60520
show 15 more
  • Red Hat OpenShift Container Platform 4.16 openshift4/ose-networking-console-plugin-rhel9 1789458004
    fixed: vendor fix RHSA-2026:67936
  • Red Hat OpenShift Container Platform 4.17 openshift4/ose-networking-console-plugin-rhel9 1789959412
    fixed: vendor fix RHSA-2026:70587
  • Red Hat OpenShift Container Platform 4.18 openshift4/ose-monitoring-plugin-rhel9 1789906578, openshift4/ose-networking-console-plugin-rhel9 1789906839
    fixed: vendor fix RHSA-2026:70617
  • Red Hat OpenShift Container Platform 4.19 openshift4/ose-console-rhel9 1788573287, openshift4/ose-monitoring-plugin-rhel9 1788318661, openshift4/ose-networking-console-plugin-rhel9 1788587831
    fixed: vendor fix RHSA-2026:66371
  • Red Hat OpenShift Container Platform 4.20 openshift4/ose-console-rhel9 1787737695, openshift4/ose-monitoring-plugin-rhel9 1787736396, openshift4/ose-networking-console-plugin-rhel9 1789009167
    fixed: vendor fix RHSA-2026:60446
  • Red Hat OpenShift Container Platform 4.21 openshift4/ose-console-rhel9 1787590523, openshift4/ose-monitoring-plugin-rhel9 1787590390, openshift4/ose-networking-console-plugin-rhel9 1788928679
    fixed: vendor fix RHSA-2026:60477
  • Red Hat OpenShift Container Platform 4.22 openshift4/ose-console-rhel9 1785910938, openshift4/ose-monitoring-plugin-rhel9 1787730804, openshift4/ose-networking-console-plugin-rhel9 1787745534
    fixed: vendor fix RHSA-2026:51038
  • Red Hat Openshift Data Foundation 4.18 odf4/cephcsi-rhel9 1786705347, odf4/odf-cli-rhel9 1786705938, odf4/mcg-core-rhel9 1786705558, odf4/odf-console-rhel9 1786706577, odf4/mcg-rhel9-operator 1786705646, odf4/ocs-rhel9-operator 1786705802, +13 more
    fixed: vendor fix RHSA-2026:56431
  • Red Hat OpenShift Dev Spaces 3.30 devspaces/code-rhel9 1789145741, devspaces/openvsx-rhel9 1789144269, devspaces/pluginregistry-rhel9 1788883179
    fixed: vendor fix RHSA-2026:68754
  • Red Hat Developer Hub 1.10 rhdh/rhdh-rhel9-operator 1785411290, rhdh/rhdh-operator-bundle 1785415596, rhdh/rhdh-must-gather-rhel9 1784202439, rhdh/rhdh-rag-content-rhel9 1785162496, rhdh/red-hat-developer-hub-backstage-plugin-lightspeed 1785333413, rhdh/red-hat-developer-hub-backstage-plugin-orchestrator 1785340831, +2 more
    not affected: vulnerable code not present
  • Red Hat Hardened Images libgit2 1.9.4-2.hum1
    not affected: component not present
  • Red Hat OpenShift AI 3.4 rhoai/odh-cli-rhel9 1787330837, rhoai/rhai-cli-rhel9 1787330837, rhoai/odh-automl-rhel9 1786612415, rhoai/odh-mlflow-rhel9 1787226790, rhoai/odh-autorag-rhel9 1786612637, rhoai/odh-trainer-rhel9 1787089049, +99 more
    not affected: vulnerable code not present
  • Red Hat OpenShift Container Platform 4 openshift4/ose-console
    not affected: vulnerable code not in execute path
  • Red Hat OpenShift Container Platform 4.16 openshift4/ose-cli-rhel9 1789361923, openshift4/ose-pod-rhel9 1789370561, openshift4/ose-sdn-rhel9 1789376367, openshift4/ose-etcd-rhel9 1789369183, openshift4/ose-tests-rhel9 1789368515, openshift4/ose-tools-rhel9 1789366012, +182 more Red Hat OpenShift Container Platform 4.17 openshift4/frr-rhel9 1789938330, openshift4/ose-cli-rhel9 1789937904, openshift4/ose-pod-rhel9 1789937463, openshift4/ose-etcd-rhel9 1789937632, openshift4/ose-tests-rhel9 1790075131, openshift4/ose-tools-rhel9 1790073665, +180 more Red Hat OpenShift Container Platform 4.18 openshift4/frr-rhel9 1789904437, openshift4/ose-cli-rhel9 1789904386, openshift4/ose-pod-rhel9 1789906731, openshift4/ose-etcd-rhel9 1789906675, openshift4/ose-tests-rhel9 1790074104, openshift4/ose-tools-rhel9 1790072642, +179 more Red Hat OpenShift Container Platform 4.19 openshift4/frr-rhel9 1788311982, openshift4/frr-rhel9 1788884480, openshift4/ose-cli-rhel9 1788311429, openshift4/ose-cli-rhel9 1788566232, openshift4/ose-pod-rhel9 1788311898, openshift4/ose-pod-rhel9 1788571150, +365 more Red Hat OpenShift Container Platform 4.20 openshift4/frr-rhel9 1787736001, openshift4/frr-rhel9 1788947245, openshift4/ose-cli-rhel9 1787735982, openshift4/ose-cli-rhel9 1788948079, openshift4/ose-pod-rhel9 1787736197, openshift4/ose-pod-rhel9 1788948309, +371 more Red Hat OpenShift Container Platform 4.21 openshift4/frr-rhel9 1787555870, openshift4/frr-rhel9 1788928525, openshift4/ose-cli-rhel9 1787556246, openshift4/ose-cli-rhel9 1788928632, openshift4/ose-pod-rhel9 1787558631, openshift4/ose-pod-rhel9 1788929363, +367 more
    +3 more products
    Red Hat OpenShift Container Platform 4.22 openshift4/frr-rhel9 1785883609, openshift4/frr-rhel9 1787570998, openshift4/ose-cli-rhel9 1785883865, openshift4/ose-cli-rhel9 1787572868, openshift4/ose-pod-rhel9 1785885460, openshift4/ose-pod-rhel9 1787573725, +369 more Red Hat Openshift Data Foundation 4.18 odf4/mcg-operator-bundle 1786708633, odf4/ocs-operator-bundle 1786708778, odf4/odf-operator-bundle 1786709119, odf4/cephcsi-operator-bundle 1786708508, odf4/odr-hub-operator-bundle 1786709184, odf4/rook-ceph-operator-bundle 1786709254, +7 more Red Hat OpenShift Dev Spaces 3.30 devspaces/server-rhel9 1789163798, devspaces/traefik-rhel9 1788882066, devspaces/udi-base-rhel9 1788883444, devspaces/code-sshd-rhel9 1789144422, devspaces/dashboard-rhel9 1789162884, devspaces/configbump-rhel9 1789143601, +6 more
    not affected: vulnerable code not present
  • Red Hat OpenShift Virtualization 4 container-native-virtualization/kubevirt-console-plugin-rhel9
    not affected: vulnerable code not in execute path

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
partial
Assessed
3 mo ago

Exploit prediction

0.39% chance of exploitation in the next 30 days, higher than 33% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/markdown-it/linkify-it/security/advisories/GHSA-22p9-wv53-3rq4 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 4.0 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CNA 4.0 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
npm linkify-it
<5.0.1
5.0.1

Affected products

  • markdown-it linkify-it

Classification

Weakness
  • CWE-1333 Inefficient Regular Expression Complexity

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.