CVE-2026-103043: anchorme through 3.0.8 Regular Expression Denial of Service
anchorme through 3.0.8 contains a regular expression denial of service vulnerability in the IPv6 host extraction regex due to catastrophic backtracking. Attackers can supply specially crafted input strings with repeated patterns to cause exponential regex engine backtracking, blocking the Node.js event loop and denying service to other requests.
Affected Software
Event History
Frequently Asked Questions
What must an attacker be able to do to trigger the issue?
They need to supply specially crafted input containing repeated patterns that is processed by anchorme's IPv6 host extraction logic. The reported CVSS vector indicates network reachability with no required privileges or user interaction.
Which deployments should be prioritized for review?
Review applications using anchorme through version 3.0.8 that process untrusted, remotely supplied strings. Successful exploitation can block the Node.js event loop and prevent other requests from being served.