diff --git a/.changeset/webmention-fix-polynomial-redos-link-header.md b/.changeset/webmention-fix-polynomial-redos-link-header.md
new file mode 100644
index 00000000..9ed6acb2
--- /dev/null
+++ b/.changeset/webmention-fix-polynomial-redos-link-header.md
@@ -0,0 +1,5 @@
+---
+"@dwk/webmention": patch
+---
+
+fix(webmention): remove ambiguous quantifier pair in `Link` header parsing regex flagged by CodeQL as a polynomial ReDoS (`js/polynomial-redos`). The redundant `\s*` immediately before `(.*)$` overlapped with what `.` can already match, allowing crafted `Link` header values (attacker-controlled, fetched from a webmention source/target) to force excessive backtracking. Parameter-leading whitespace is still stripped by the per-parameter `rel` regex in `extractRel`, so behavior is unchanged.
diff --git a/packages/webmention/src/html.ts b/packages/webmention/src/html.ts
index 22c3cf9b..60c9c4c1 100644
--- a/packages/webmention/src/html.ts
+++ b/packages/webmention/src/html.ts
@@ -37,7 +37,7 @@ export function parseLinkHeader(value: string | null): LinkHeaderEntry[] {
   }
   const entries: LinkHeaderEntry[] = [];
   for (const part of splitLinks(value)) {
-    const match = /^\s*<([^>]*)>\s*(.*)$/.exec(part);
+    const match = /^\s*<([^>]*)>(.*)$/.exec(part);
     if (match === null) {
       continue;
     }