CVE-2026-103043
anchorme through 3.0.8 contains a regular expression denial of service vulnerability in the IPv6 host extraction regex due to catastrophic backtracking.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.59%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
anchorme through 3.0.8 contains a regular expression denial of service vulnerability in the IPv6 host extraction regex due to catastrophic backtracking. Attackers can supply specially crafted input strings with repeated patterns to cause exponential regex engine backtracking, blocking the Node.js event loop and denying service to other requests.
- CVSS 4.0
- 8.7 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 0.59% probability · 48th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-1333
- Source
- disclosure@vulncheck.com
EPSS moved from 0.4% on 30 September 2026 to 0.6% on 26 October 2026.
References
- https://gist.github.com/R3tro16/92948206e9893a3739b91746439384ab
- https://gist.github.com/mmadersbacher/46050b4224eb979431986cdef1dd2ad3
- https://github.com/alexcorvi/anchorme.js
- https://github.com/alexcorvi/anchorme.js/blob/f3ae9850baa344f27b46bb149e9b891831d273b1/src/index.ts#L109
- https://www.npmjs.com/package/anchorme
- https://www.vulncheck.com/advisories/anchorme-through-3.0.8-regular-expression-denial-of-service
- https://gist.github.com/mmadersbacher/46050b4224eb979431986cdef1dd2ad3
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.