CVE-2026-103043CWE-1333

CVE-2026-103043

High · published September 30, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
40.8
In the wild
Unconfirmed
What it is

anchorme through 3.0.8 contains a regular expression denial of service vulnerability in the IPv6 host extraction regex due to catastrophic backtracking. Attackers can supply specially crafted input strings with repeated patterns to cause exponential regex engine backtracking, blocking the Node.js event loop and denying service to other requests.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00485 · 40.8th percentile
Weakness
CWE-1333 · Inefficient Regular Expression Complexity
Published
2026-09-30T03:17Z
References (7)
https://gist.github.com/R3tro16/92948206e9893a3739b91746439384ab · [email protected]https://gist.github.com/mmadersbacher/46050b4224eb979431986cdef1dd2ad3 · [email protected]https://github.com/alexcorvi/anchorme.js · [email protected]https://github.com/alexcorvi/anchorme.js/blob/f3ae9850baa344f27b46bb149e9b891831d273b1/src/index.ts#L109 · [email protected]https://www.npmjs.com/package/anchorme · [email protected]https://www.vulncheck.com/advisories/anchorme-through-3.0.8-regular-expression-denial-of-service · [email protected]https://gist.github.com/mmadersbacher/46050b4224eb979431986cdef1dd2ad3 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 01 OCT 03:44Z
    EPSS moved — → 0%
    epss
  • 29 SEP 22:51Z
    anchorme through 3.0.8 Regular Expression Denial of Service
    cvelistv5