CVE-2024-48801: Algorithmic Complexity DoS in linkify-it

Vulnerability Overview Vulnerability Name: Quadratic algorithmic complexity in LinkifyIt#match scan loop CVE ID: CVE-2024-48801 CVSS v4 base metrics: 8.7 / 10 Severity: High Description: is the primary public API of the package and exhibits O(N²) algorithmic complexity for inputs containing numerous fuzzy links or emails. This is not a regex backtracking issue but a structural problem within the JS-level scanning loop, which re-enters and re-runs unanchored regex searches with a progressively shrinking length N times. A 64 KB repeated string takes approximately 2.5 seconds to process (single-threaded CPU); 128 KB requires about 10 seconds. Doubling the input size quadruples the execution time, exhibiting O(N²) tail behavior. The same performance cost is propagated through without modification. Any service synchronously rendering untrusted Markdown in a request-hot path (forums, comments, chat, AI chat UIs) inherits a worker Denial-of-Service (DoS) vulnerability, triggered by request bodies of tens of kilobytes. Affected Scope Affected Components: HEAD Audit: 94607d5bac9f95b09e1ad1f784d27a934d4f175f4 (v5.0.0) Vulnerable Function: — Rescanning Call Sites in : (fuzzy host search), :447 (fuzzy link match), :467 (fuzzy email match) Consumer: (~21.6M weekly npm DLs) calls in when is enabled All versions affected — The vulnerability loop has existed in versions prior to v5.0.0 since the initial commit (2014) Impact: Availability (High): A single HTTP request containing tens of KB of repeated email strings can block a worker process thread for tens of seconds to several minutes. At moderate concurrency (10-50 requests), the entire rendering layer becomes blocked. No confidentiality or integrity impact. Real-World Scenario: Any service rendering untrusted Markdown server-side with enabled — including Discourse, Mattermost, GitLab CE, AI chat UIs (Open WebUI, LibreChat), and wikiNote applications using — accepts posts containing 64 KB of . The rendering call blocks the worker process for 2.5+ seconds. Scripted scaling can block the rendering layer entirely. Remediation Recommended Fix: The fix is algorithmic — converting the external scanning loop into state-machine regex iteration so that each character is checked a constant number of times: 1. Add the flag to , , , and in . 2. Rewrite (or add ) so that the fuzzy branch sets and calls instead of / on the sliced tail. 3. In , discard entirely — advance the offset instead. PoC Code: Measured Output (Node v25.5.0, Apple Silicon): markdown-it Propagation (Independently Confirmed): Measured Output: Note: 64 KB is sufficient to burn 2.6 seconds in . Repetition Risk Zero GHASAs in ( ) Zero OSV entries ( ) The only GHSA for ( , "Possible ReDoS in newline rule") targets 's own newline regex, not This finding appears to be novel. Maintainer Notes Since is the primary consumer and shares maintainership (Vitaly Puzin), releasing a patch for should be paired with a minor version of that pins the new minimum version. We are happy to assist with the fix PR if useful.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2024-48801: Algorithmic Complexity DoS in linkify-it

More from this source