--- id: CVE-2026-48801 title: >- linkify-it: linkify-it: Denial of Service via algorithmic complexity vulnerability (CVE-2026-48801) summary: >- A flaw was found in linkify-it, a library for recognizing links with full Unicode support. The LinkifyIt.prototype.match function, the package's primary public API, has an algorithmic complexity of O(N²) for inputs containing many fuzzy li… severity: high cvss: 7.5 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H' cvssSource: vendor cwe: CWE-1333 vendor: Red Hat product: Red Hat Openshift Data Foundation 4.18 affected: - migration_toolkit_for_virtualization - node_healthcheck_operator - openshift_pipelines - build_of_podman_desktop - openshift_container_platform 4 - openshift_dev_spaces - enterprise_linux_extensions_channel_v_10 - ansible_automation_platform 2.1 - ansible_automation_platform 2.2 - developer_hub 1.10 - hardened_images - openshift_ai 3.4 - openshift_container_platform 4.21 - openshift_container_platform 4.22 - openshift_container_platform 4.2 - openshift_data_foundation 4.18 patched: - enterprise_linux_extensions_channel_v_10 - ansible_automation_platform 2.1 - ansible_automation_platform 2.2 - developer_hub 1.10 - hardened_images - openshift_ai 3.4 - openshift_container_platform 4.21 - openshift_container_platform 4.22 - openshift_container_platform 4.2 - openshift_data_foundation 4.18 published: '2026-07-14' updated: '2026-09-08' sourceUpdated: '2026-09-08T11:30:52+00:00' source: CSAF sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48801.json' references: - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48801.json - url: 'https://access.redhat.com/security/cve/CVE-2026-48801' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2500656' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-48801' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-48801' - url: >- https://github.com/markdown-it/linkify-it/commit/6be6d15e0641bf1daeaa977d500cabc743166159 - url: >- https://github.com/markdown-it/linkify-it/security/advisories/GHSA-22p9-wv53-3rq4 - url: 'https://access.redhat.com/errata/RHSA-2026:57590' - url: 'https://access.redhat.com/errata/RHSA-2026:50850' - url: 'https://access.redhat.com/errata/RHSA-2026:42815' - url: 'https://access.redhat.com/errata/RHSA-2026:51162' - url: 'https://access.redhat.com/errata/RHSA-2026:48126' - url: 'https://access.redhat.com/errata/RHSA-2026:49642' - url: 'https://access.redhat.com/errata/RHSA-2026:38187' - url: 'https://access.redhat.com/errata/RHSA-2026:60520' - url: 'https://access.redhat.com/errata/RHSA-2026:60477' - url: 'https://access.redhat.com/errata/RHSA-2026:51038' - url: 'https://access.redhat.com/errata/RHSA-2026:60441' - url: 'https://access.redhat.com/errata/RHSA-2026:60446' - url: 'https://access.redhat.com/errata/RHSA-2026:56431' - url: 'https://github.com/advisories/GHSA-22p9-wv53-3rq4' tags: - csaf - vex - red-hat - ghsa - npm epss: 0.00366 epssPercentile: 0.30465 ecosystem: npm ingestedAt: '2026-06-29T13:24:35.267Z' --- ## Overview A flaw was found in linkify-it, a library for recognizing links with full Unicode support. The LinkifyIt.prototype.match function, the package's primary public API, has an algorithmic complexity of O(N²) for inputs containing many fuzzy links or emails. This can be exploited by a remote attacker sending a specially crafted request body, leading to a worker-process denial of service (DoS) due to excessive CPU usage when synchronously rendering untrusted Markdown with linkify enabled. ## Vendor advisories - **RHSA-2026:57590** · Red Hat · fixed in: Red Hat Enterprise Linux Extensions Channel (v. 10) · released 2026-08-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:57590) - **RHSA-2026:50850** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.1 · released 2026-08-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:50850) - **RHSA-2026:42815** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.2 · released 2026-07-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:42815) - **RHSA-2026:51162** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.2 · released 2026-08-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:51162) - **RHSA-2026:48126** · Red Hat · fixed in: Red Hat Developer Hub 1.10 · released 2026-07-29 · [advisory](https://access.redhat.com/errata/RHSA-2026:48126) - **RHSA-2026:49642** · Red Hat · fixed in: Red Hat Developer Hub 1.10 · released 2026-08-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:49642) - **RHSA-2026:38187** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-07-11 · [advisory](https://access.redhat.com/errata/RHSA-2026:38187) - **RHSA-2026:60520** · Red Hat · fixed in: Red Hat OpenShift AI 3.4 · released 2026-08-27 · [advisory](https://access.redhat.com/errata/RHSA-2026:60520) - **RHSA-2026:60477** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.21 · released 2026-09-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:60477) - **RHSA-2026:51038** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.22 · released 2026-08-11 · [advisory](https://access.redhat.com/errata/RHSA-2026:51038) - **RHSA-2026:60441** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.22 · released 2026-09-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:60441) - **Red Hat VEX** · Moderate · affected: Migration Toolkit for Virtualization, Node HealthCheck Operator, OpenShift Pipelines, Red Hat Build of Podman Desktop, Red Hat OpenShift Container Platform 4, Red Hat OpenShift Dev Spaces · no fix planned: Migration Toolkit for Virtualization, Node HealthCheck Operator, OpenShift Pipelines, Red Hat Build of Podman Desktop, … · updated 2026-09-08 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48801.json) **linkify-it: linkify-it: Denial of Service via algorithmic complexity vulnerability** — rated Moderate by Red Hat. Released 2026-07-14, updated 2026-09-08. Affected: - Migration Toolkit for Virtualization - Node HealthCheck Operator - OpenShift Pipelines - Red Hat Build of Podman Desktop - Red Hat OpenShift Container Platform 4 - Red Hat OpenShift Dev Spaces Fixed: - Red Hat Enterprise Linux Extensions Channel (v. 10) - Red Hat Ansible Automation Platform 2.1 - Red Hat Ansible Automation Platform 2.2 - Red Hat Developer Hub 1.10 - Red Hat Hardened Images - Red Hat OpenShift AI 3.4 - Red Hat OpenShift Container Platform 4.21 - Red Hat OpenShift Container Platform 4.22 - Red Hat OpenShift Container Platform 4.2 - Red Hat Openshift Data Foundation 4.18 No fix planned: - Migration Toolkit for Virtualization - Node HealthCheck Operator - OpenShift Pipelines - Red Hat Build of Podman Desktop - Red Hat OpenShift Container Platform 4 - Red Hat OpenShift Dev Spaces Not affected: - Red Hat Developer Hub 1.10 - Red Hat OpenShift AI 3.4 - Red Hat OpenShift Container Platform 4.21 - Red Hat OpenShift Container Platform 4.22 - Red Hat OpenShift Container Platform 4.2 - Red Hat Openshift Data Foundation 4.18 - Red Hat Hardened Images - Red Hat OpenShift Container Platform 4 - Red Hat OpenShift Virtualization 4 ## Remediation For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:57590 For more about Ansible plugins for Red Hat Developer Hub, see References links https://access.redhat.com/errata/RHSA-2026:50850 For more about Ansible plugins for Red Hat Developer Hub, see References links https://access.redhat.com/errata/RHSA-2026:42815 ## Package advisory (CVE-2026-48801) Affected packages: - `linkify-it <= 5.0.0` Patched in: - `linkify-it 5.0.1` Source: https://github.com/advisories/GHSA-22p9-wv53-3rq4