https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 22 Oct 2026 01:55:04 +0000 https://db.gcve.eu/vuln/ghsa-253c-mchw-3w2r <p><strong>Affected:</strong> npm: markdown-it</p> <p>## Summary</p> <p>Two independent quadratic paths in the `linkify: true` handling. Both are in markdown-it&#39;s own code rather than in linkify-it, which stays linear on both payloads.</p> <p>`src/rules_core/linkify.ts` calls `arrayReplaceAt` once per linkified text token, and that rebuilds the whole `children` array each time. A paragraph of N soft-broken lines is one inline token with about 2N children, so you get N rebuilds over a 2N array. Schema-less emails are what reach it. A `http://` link gets consumed by the inline rule first and never arrives as a text token, so those stay linear.</p> <p>`src/rules_inline/linkify.ts` runs `state.pending.match(SCHEME_RE)` at every `://` in the source. `state.pending` only gets truncated once a link is actually produced, so an unregistered scheme leaves it growing and every `://` rescans the lot.</p> <p>## Proof of concept</p> <p>Clean install of 15.0.0 from npm, `new MarkdownIt({ linkify: true }).render(payload)`, Node 24.</p> <p>| N | 5,000 | 10,000 | 20,000 | 40,000 | |---|---|---|---|---| | `&#39;a@b.co\n&#39;.repeat(N)`, 34KB to 273KB | 1.1s | 4.7s | 19.6s | 89s | | `&#39;a://&#39;.repeat(N)`, 20KB to 156KB | 0.25s | 0.76s | 3.1s | 15.0s |</p> <p>Doubling the input roughly quadruples the time in both. With `linkify: false` the same inputs run in 25 to 131ms and stay flat.</p> <p>Controls for the first one, all at N=20000: putting every email in a single text token (`&#39;a@b.co &#39;`) takes 0.59s, one email per paragraph (`&#39;a@b.co\n\n&#39;`) takes 0.64s, and soft-broken lines with nothing linkifiable tak…</p> <p><strong>Affected:</strong> npm: markdown-it</p> <p>## Summary</p> <p>Two independent quadratic paths in the `linkify: true` handling. Both are in markdown-it&#39;s own code rather than in linkify-it, which stays linear on both payloads.</p> <p>`src/rules_core/linkify.ts` calls `arrayReplaceAt` once per linkified text token, and that rebuilds the whole `children` array each time. A paragraph of N soft-broken lines is one inline token with about 2N children, so you get N rebuilds over a 2N array. Schema-less emails are what reach it. A `http://` link gets consumed by the inline rule first and never arrives as a text token, so those stay linear.</p> <p>`src/rules_inline/linkify.ts` runs `state.pending.match(SCHEME_RE)` at every `://` in the source. `state.pending` only gets truncated once a link is actually produced, so an unregistered scheme leaves it growing and every `://` rescans the lot.</p> <p>## Proof of concept</p> <p>Clean install of 15.0.0 from npm, `new MarkdownIt({ linkify: true }).render(payload)`, Node 24.</p> <p>| N | 5,000 | 10,000 | 20,000 | 40,000 | |---|---|---|---|---| | `&#39;a@b.co\n&#39;.repeat(N)`, 34KB to 273KB | 1.1s | 4.7s | 19.6s | 89s | | `&#39;a://&#39;.repeat(N)`, 20KB to 156KB | 0.25s | 0.76s | 3.1s | 15.0s |</p> <p>Doubling the input roughly quadruples the time in both. With `linkify: false` the same inputs run in 25 to 131ms and stay flat.</p> <p>Controls for the first one, all at N=20000: putting every email in a single text token (`&#39;a@b.co &#39;`) takes 0.59s, one email per paragraph (`&#39;a@b.co\n\n&#39;`) takes 0.64s, and soft-broken lines with nothing linkifiable tak…</p> https://db.gcve.eu/vuln/ghsa-253c-mchw-3w2r