CVE-2026-102994

A flaw was found in pypdf. By supplying a specially crafted PDF document containing excessively long indirect object identifiers or generation tokens without whitespace, a remote attacker can trigger unbounded input scanning during parsing. This issue causes significant processing delays and...

GHSA-V245-V573-V5VM linkify-it: Quadratic-complexity DoS via the `mailto:` validator scan-loop on attacker text

Summary linkify-it's schema-scan loop .test / .match, the documented public API invokes the mailto: schema validator at every mailto: occurrence in the input text. For each occurrence the validator does text.slicepos an On copy and runs an email regex whose local-part class srcemailname greedily...

CVE-2026-48801

linkify-it is a links recognition library with full Unicode support. Prior to 5.0.1, LinkifyIt.prototype.match, the package's primary public API, has ON² algorithmic complexity for inputs containing many fuzzy links or emails because the JavaScript-level scan loop re-slices input and re-runs...