CVE-2026-103043 — anchorme through 3.0.8 Regular Expression Denial of Service
anchorme through 3.0.8 contains a regular expression denial of service vulnerability in the IPv6 host extraction regex due to catastrophic backtracking. Attackers can supply spe…
Published: 2026-09-29 · CVSS: 8.7 · CVSS 4.0
anchorme through 3.0.8 contains a regular expression denial of service vulnerability in the IPv6 host extraction regex due to catastrophic backtracking. Attackers can supply specially crafted input strings with repeated patterns to cause exponential regex engine backtracking, blocking the Node.js event loop and denying service to other requests.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7