Is CVE-2026-59887 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-59887?

CVE-2026-59887 has a CVSS v3 severity of HIGH (7.5).

Back

CVE-2026-59887

Description

linkify-it is a links recognition library with full Unicode support. Prior to 5.0.2, the mailto: schema validator used by .test() and .match() can be invoked at every mailto: occurrence and scan the remaining input through src_email_name in lib/re.mjs, causing O(n^2) CPU consumption on crafted user text. This issue is fixed in version 5.0.2.