linkify-it: Quadratic CPU usage in LinkifyIt.prototype.match
LinkifyIt.prototype.match has O(N²) algorithmic complexity due to re-slicing the input and re-running unanchored regex searches on progressively shorter tails,
What changed
LinkifyIt.prototype.match has O(N²) algorithmic complexity due to re-slicing the input and re-running unanchored regex searches on progressively shorter tails, causing quadratic CPU time for inputs with many fuzzy links or emails.
Who it affects
All users of linkify-it (all versions) and transitive consumers like markdown-it with linkify:true, especially services rendering untrusted Markdown on request hot-paths (forums, comments, chat, wikis, AI chat UIs).
What to do today
Apply the suggested remediation: convert the outer scan loop to stateful regex iteration with g-flag and lastIndex, and drop tail.slice() in match().