Severity: high
CVE: CVE-2026-59887
Package: linkify-it @ 5.0.1
Vulnerable range: <=5.0.1
Patched in: >=5.0.2
Dep paths:
lib__api-spec>orval>typedoc>markdown-it>linkify-it
linkify-it: Quadratic-complexity DoS via the mailto: validator scan-loop on attacker text
Reference: GHSA-v245-v573-v5vm
Filed automatically by .github/workflows/pnpm-audit.yml. The fix
work for this CVE belongs in its own task; see
docs/security-audit-public-2026-04.md §11 limitation 4 for the
policy. Either bump the affected dep (closes this issue on the next
scheduled run) or add an entry to scripts/audit/ignore-list.json
with a written reachability rationale and a re-evaluation date.
Severity: high
CVE: CVE-2026-59887
Package:
linkify-it@5.0.1Vulnerable range:
<=5.0.1Patched in:
>=5.0.2Dep paths:
lib__api-spec>orval>typedoc>markdown-it>linkify-itReference: GHSA-v245-v573-v5vm
Filed automatically by
.github/workflows/pnpm-audit.yml. The fixwork for this CVE belongs in its own task; see
docs/security-audit-public-2026-04.md§11 limitation 4 for thepolicy. Either bump the affected dep (closes this issue on the next
scheduled run) or add an entry to
scripts/audit/ignore-list.jsonwith a written reachability rationale and a re-evaluation date.