Skip to main content
cve.nowby Sazabi
← npm
npmPackage

linkify-it

2 known vulnerabilities (2 high), with the versions each affects and the releases that fix them.

Latest release
6.1.0 (Jul 22, 2026): no advisory affects it
Newest unaffected release
6.1.0 (Jul 22, 2026), the latest release
Advisories
2 · 2 high
Weekly downloads
46.5M
Dependents
1,104
Releases
32 since 0.1.0 (Feb 12, 2015)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 2

  • linkify-it: Quadratic algorithmic complexity in LinkifyIt#match scan loop

    Affected: fixed in 5.0.1.

    Fixed in 5.0.1 (released May 23, 2026, 52 days before disclosure).

    The latest release, 6.1.0, is not affected.

    39% of linkify-it downloads last week were affected versions (20.4M).

  • linkify-it: Quadratic-complexity DoS via the `mailto:` validator scan-loop on attacker text

    Affected: fixed in 5.0.2.

    Fixed in 5.0.2 (released Jul 1, 2026, 7 days before disclosure).

    The latest release, 6.1.0, is not affected.

    43% of linkify-it downloads last week were affected versions (22.4M).