linkify-it is a links recognition library with full Unicode support. Prior to 5.0.2, the mailto: schema validator used by .test() and .match() can be invoked at…

The linkify-it JavaScript library, used for link recognition with full Unicode support, contains a ReDoS-style vulnerability prior to version 5.0.2. The mailto: schema validator invoked by .test() and .match() methods can be triggered at every mailto: occurrence in input text, causing it to scan the remaining input via src_email_name in lib/re.mjs. This results in O(n^2) CPU consumption when processing crafted user-supplied text, making it susceptible to denial-of-service attacks. The vulnerability affects all versions of linkify-it prior to 5.0.2. A fix has been released in version 5.0.2 of the library. The issue is tracked under CVE-2026-59887 and has an associated GitHub Security Advisory GHSA-v245-v573-v5vm. Users and maintainers of projects depending on linkify-it should upgrade to version 5.0.2 or later immediately.