CVE-2026-103043

anchorme through 3.0.8 contains a regular expression denial of service vulnerability in the IPv6 host extraction regex due to catastrophic backtracking. Attackers can supply specially crafted input strings with repeated patterns to cause exponential regex engine backtracking, blocking the Node.js event loop and denying service to other requests.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://gist.github.com/R3tro16/92948206e9893a3739b91746439384ab
https://gist.github.com/mmadersbacher/46050b4224eb979431986cdef1dd2ad3
https://github.com/alexcorvi/anchorme.js
https://github.com/alexcorvi/anchorme.js/blob/f3ae9850baa344f27b46bb149e9b891831d273b1/src/index.ts#L109
https://www.npmjs.com/package/anchorme
https://www.vulncheck.com/advisories/anchorme-through-3.0.8-regular-expression-denial-of-service
https://gist.github.com/mmadersbacher/46050b4224eb979431986cdef1dd2ad3

Configurations

No configuration.

History

20 Oct 2026, 02:17

Type	Values Removed	Values Added
References		() https://gist.github.com/R3tro16/92948206e9893a3739b91746439384ab -

30 Sep 2026, 20:17

Type	Values Removed	Values Added
References	~~() https://gist.github.com/mmadersbacher/46050b4224eb979431986cdef1dd2ad3 -~~	() https://gist.github.com/mmadersbacher/46050b4224eb979431986cdef1dd2ad3 -

29 Sep 2026, 23:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-29 23:17

Updated : 2026-10-20 02:17

NVD link : CVE-2026-103043

Mitre link : CVE-2026-103043

CVE.ORG link : CVE-2026-103043

JSON object : View

Products Affected

No product.

CWE

CWE-1333

Inefficient Regular Expression Complexity

{"id": "CVE-2026-103043", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-103043", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-30T19:13:47.555563Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/alexcorvi/anchorme.js", "vendor": "alexcorvi", "product": "anchorme", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.0.8"}], "packageURL": "pkg:npm/anchorme", "packageName": "anchorme", "defaultStatus": "unaffected"}]}], "published": "2026-09-29T23:17:22.023", "references": [{"url": "https://gist.github.com/R3tro16/92948206e9893a3739b91746439384ab", "source": "disclosure@vulncheck.com"}, {"url": "https://gist.github.com/mmadersbacher/46050b4224eb979431986cdef1dd2ad3", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/alexcorvi/anchorme.js", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/alexcorvi/anchorme.js/blob/f3ae9850baa344f27b46bb149e9b891831d273b1/src/index.ts#L109", "source": "disclosure@vulncheck.com"}, {"url": "https://www.npmjs.com/package/anchorme", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/anchorme-through-3.0.8-regular-expression-denial-of-service", "source": "disclosure@vulncheck.com"}, {"url": "https://gist.github.com/mmadersbacher/46050b4224eb979431986cdef1dd2ad3", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-1333"}]}], "descriptions": [{"lang": "en", "value": "anchorme through 3.0.8 contains a regular expression denial of service vulnerability in the IPv6 host extraction regex due to catastrophic backtracking. Attackers can supply specially crafted input strings with repeated patterns to cause exponential regex engine backtracking, blocking the Node.js event loop and denying service to other requests."}], "lastModified": "2026-10-20T02:17:08.543", "sourceIdentifier": "disclosure@vulncheck.com"}