AIKIDO-2026-144803
linkify-it-py is vulnerable to Denial of Service (DoS)
75
High Risk
This Affects:
linkify-it-pyTL;DR
LinkifyIt.match() scans text for links by repeatedly slicing the remaining tail and running unanchored regular expression searches over it. On input containing many fuzzy email candidates or repeated mailto: prefixes, this rescanning makes the function run in quadratic time. Because fuzzy email matching is enabled by default, untrusted input handed to the matcher or to a Markdown renderer with linkify enabled can stall the process. The fix matches validators at a fixed position with compiled patterns and caps email name and auth component lengths so the tail is not repeatedly rescanned.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you pass untrusted input to LinkifyIt.match(), directly or through a Markdown renderer with linkify enabled.
Background info
linkify-it-py is vulnerable to Denial of Service (DoS) in versions 0.0.1 - 2.1.0.
How to fix this
Upgrade the linkify-it-py library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant