IA Squad
SearchPT
js · linkify-itCritical

linkify-it: Quadratic CPU usage in LinkifyIt.prototype.match

LinkifyIt.prototype.match has O(N²) algorithmic complexity due to re-slicing the input and re-running unanchored regex searches on progressively shorter tails,

27 Jun 2026Read 1 minSeverity: act now

What changed

LinkifyIt.prototype.match has O(N²) algorithmic complexity due to re-slicing the input and re-running unanchored regex searches on progressively shorter tails, causing quadratic CPU time for inputs with many fuzzy links or emails.

Who it affects

All users of linkify-it (all versions) and transitive consumers like markdown-it with linkify:true, especially services rendering untrusted Markdown on request hot-paths (forums, comments, chat, wikis, AI chat UIs).

What to do today

Apply the suggested remediation: convert the outer scan loop to stateful regex iteration with g-flag and lastIndex, and drop tail.slice() in match().

The trail
Collected Audited Written Published