CVE-2026-48801

What it actually does

CVE-2026-48801 is an algorithmic-complexity denial-of-service flaw in the linkify-it JavaScript library before version 5.0.1. The vulnerable public API, LinkifyIt.prototype.match, can take quadratic time when processing text containing many fuzzy links or email-like strings because it repeatedly slices the remaining input and re-runs unanchored regular-expression searches. Applications that synchronously render untrusted Markdown or rich text with linkification enabled, especially with markdown-it linkify:true or equivalent behavior, can have a Node.js worker or request-handling thread tied up by a relatively small request body, potentially degrading availability without authentication or user interaction.

Why it matters to the business

A remote unauthenticated attacker may be able to make affected web services slow, unresponsive, or intermittently unavailable by submitting crafted text to endpoints that render Markdown or linkify user-supplied content. The practical impact is service degradation, increased latency, failed requests, autoscaling cost spikes, and potential outage of features such as developer portals, automation interfaces, documentation systems, issue trackers, comment systems, chat-style inputs, or content-preview APIs. This issue is not listed in CISA KEV, is not known to be used in ransomware campaigns, has low EPSS probability, and has no reported exploit maturity, but availability impact is high where vulnerable parsing occurs on request hot paths. Red Hat has released fixes under RHSA-2026:51162 for affected downstream products.

How an attack unfolds

An attacker identifies an application endpoint that accepts user-controlled text and renders or previews it synchronously using Markdown or linkification. They submit a request body of tens of kilobytes containing many URL-like or email-like fragments designed to trigger repeated fuzzy-link matching. In vulnerable versions of linkify-it, each scan over the remaining input causes additional slicing and unanchored regex matching, causing processing time to grow disproportionately as the payload grows. Because the work occurs in the application process, a single request can monopolize a Node.js event loop or worker process for an extended period. Repeated requests can exhaust available workers, increase queue depth, trigger timeouts and 5xx responses, and deny service to legitimate users. No credential theft, code execution, or data modification is inherent to the flaw; the primary attacker objective is availability disruption.

How to fix it

Upgrade linkify-it to version 5.0.1 or later wherever it is used directly or transitively. For Red Hat-packaged products, apply RHSA-2026:51162 and upgrade to the relevant fixed builds: ansible-automation fixed in platform/automation-portal:1784622951; ansible-automation-platform/bootc-automation fixed in portal-rhel9:1786006573; rhdh/red-hat-developer-hub-backstage-plugin fixed in orchestrator-backend:1785332825; rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend fixed in module-loki:1785332668; rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend fixed in module-orchestrator:1785332694; rhdh/rhdh fixed in hub-rhel9:1785411652; rust-main fixed in 1.97.0-1.1.hum1. If immediate upgrade is not possible, reduce exposure by disabling automatic linkification of untrusted Markdown, enforcing strict request body size limits for text-rendering endpoints, moving Markdown rendering off request hot paths, applying request timeouts and worker isolation, rate-limiting unauthenticated submissions, and caching or asynchronously processing expensive render operations.

How to confirm the fix worked

Confirm dependency resolution no longer includes linkify-it versions before 5.0.1 by inspecting package-lock.json, npm-shrinkwrap.json, yarn.lock, pnpm-lock.yaml, SBOMs, container image manifests, and application build artifacts. For Red Hat deployments, verify the installed image or package build matches the RHSA-2026:51162 fixed version for the affected product. Exercise representative Markdown rendering and preview endpoints with benign large inputs and confirm processing time remains bounded and does not spike CPU or block workers. Verify compensating controls are active where applicable: request body limits, per-route timeouts, rate limits, and disabled linkify behavior for untrusted content. Monitor after deployment for reduced latency, fewer timeout responses, and absence of sustained CPU saturation during text-rendering requests.

Typical attack path

1. Find an internet-facing or internal endpoint that accepts Markdown, comments, descriptions, issue text, documentation content, templates, or preview input.
2. Confirm the application uses linkify-it directly or through Markdown rendering with linkify behavior enabled.
3. Send crafted text containing many fuzzy URL-like or email-like tokens, usually in a tens-of-kilobyte body.
4. Cause LinkifyIt.prototype.match to perform quadratic-time scanning in a synchronous request path.
5. Repeat or parallelize requests to tie up worker processes or the Node.js event loop.
6. Observe elevated response times, request timeouts, 502/503/504 errors, increased CPU usage, and degraded service availability.

How to detect it

There are no public, definitive exploitation indicators for this vulnerability, and it is not currently listed as exploited in the wild. Detection should focus on behavioral evidence of attempted denial of service against endpoints that render Markdown, linkify text, preview content, or process comments/descriptions. Review web access logs, API gateway logs, WAF logs, application logs, APM traces, Node.js event-loop metrics, container CPU metrics, and reverse-proxy logs for large POST/PUT/PATCH requests to text-rendering endpoints followed by high latency, upstream timeouts, 499/500/502/503/504 responses, worker restarts, or CPU saturation. Inspect captured request bodies where legally and operationally permitted for many repeated fuzzy URL-like or email-like substrings. In application telemetry, look for slow spans or stack traces involving LinkifyIt.prototype.match, linkify-it, markdown-it, Markdown rendering, or content preview handlers. Correlate spikes from the same source IP, user agent, API token, session, or unauthenticated route with elevated event-loop lag and request queueing.

• linkify-it@0.
• linkify-it@1.
• linkify-it@2.
• linkify-it@3.
• linkify-it@4.
• LinkifyIt.prototype.match
• node_modules/linkify-it
• node_modules/linkify-it/lib/index.js
• "linkify":true
• linkify: true
• markdown-it
• upstream timed out
• request timed out
• HTTP 502
• HTTP 503
• HTTP 504
• Error: socket hang up
• event loop lag
• JavaScript heap out of memory

What your security team should do

• Inventory applications and containers that use linkify-it directly or via Markdown renderers such as markdown-it with linkify:true.
• Prioritize patching internet-facing, unauthenticated, or high-traffic services that render user-supplied Markdown synchronously.
• Upgrade linkify-it to 5.0.1 or later and apply RHSA-2026:51162 fixed Red Hat builds where applicable.
• Where patching is delayed, disable automatic linkification for untrusted content or move rendering to isolated asynchronous workers.
• Enforce small, business-appropriate request body limits on Markdown, comment, description, and preview endpoints.
• Add rate limiting and timeout controls for unauthenticated or low-trust text-submission routes.
• Add performance monitoring alerts for sudden CPU saturation, event-loop lag, rendering latency, and spikes in 502/503/504 responses.
• Search historical logs for unusually large text-rendering requests correlated with request timeouts or CPU spikes, even though there is currently no known widespread exploitation.