linkify-it is a links recognition library with full Unicode support. Prior to 5.0.1, LinkifyIt.prototype.match, the packages primary public API, has O(N²) algorithmic complexity for inputs containing many fuzzy links or emails because the JavaScript-level scan loop re-slices input and re-runs unanchored regex searches on progressively shorter tails. Any service that synchronously renders untrusted Markdown with linkify:true on a request hot path can inherit a worker-process denial of service triggerable by a tens-of-KB request body. This issue is fixed in version 5.0.1.
Weakness
The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Linkify-it | Markdown-it | * | 5.0.1 (excluding) |
| Red Hat Ansible Automation Platform 2.1 | RedHat | ansible-automation-platform/automation-portal:1785854226 | * |
| Red Hat Ansible Automation Platform 2.2 | RedHat | ansible-automation-platform/automation-portal:1784622951 | * |
| Red Hat Ansible Automation Platform 2.2 | RedHat | ansible-automation-platform/bootc-automation-portal-rhel9:1786006573 | * |
| Red Hat Developer Hub 1.10 | RedHat | rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend:1785332825 | * |
| Red Hat Developer Hub 1.10 | RedHat | rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki:1785332668 | * |
| Red Hat Developer Hub 1.10 | RedHat | rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator:1785332694 | * |
| Red Hat Developer Hub 1.10 | RedHat | rhdh/rhdh-hub-rhel9:1785411652 | * |
| Red Hat Hardened Images | RedHat | rust-main-1.97.0-1.1.hum1 | * |