CVE-2026-103043 in anchorme
Summary
by MITRE • 09/30/2026
anchorme through 3.0.8 contains a regular expression denial of service vulnerability in the IPv6 host extraction regex due to catastrophic backtracking. Attackers can supply specially crafted input strings with repeated patterns to cause exponential regex engine backtracking, blocking the Node.js event loop and denying service to other requests.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/30/2026
The anchorme library through version 3.0.8 is susceptible to a regular expression denial of service vulnerability specifically within its IPv6 host extraction logic. This flaw stems from catastrophic backtracking in the underlying regex engine used to parse and validate Internet Protocol version 6 addresses. Regular expressions are powerful tools for pattern matching, but they can exhibit exponential time complexity when faced with inputs that trigger excessive backtracking. In this specific case, the regular expression designed to identify IPv6 hosts lacks sufficient constraints or atomic grouping mechanisms to prevent the engine from exploring an exponentially large number of potential match paths when processing malformed input strings crafted by an attacker.
When a user supplies specially constructed input containing repeated patterns or ambiguous delimiters that align with the regex structure but do not constitute valid IPv6 addresses, the Node.js regular expression engine enters a state of catastrophic backtracking. Instead of quickly determining that no match exists and returning control to the application, the engine spends an excessive amount of time trying different combinations of character matches against the pattern. This computational overhead is significant enough to block the single-threaded event loop in Node.js applications that utilize anchorme for URL parsing or linkification tasks.
The operational impact of this vulnerability is a complete denial of service for any application relying on this library within its request handling pipeline. Because Node.js operates on an asynchronous, non-blocking I/O model driven by a single main thread, the prolonged execution time caused by the regex backtracking effectively freezes all other concurrent operations. This includes serving web pages, processing API requests, and managing database connections. Consequently, legitimate users are unable to interact with the application until the malicious request completes or is forcibly terminated, leading to significant service degradation or total unavailability depending on the volume of such attacks.
This vulnerability aligns with Common Weakness Enumeration (CWE) category CWE-1325, which covers Regular Expression Denial of Service (ReDoS). It also maps to MITRE ATT&CK technique T1496, Resource Hijacking, specifically under the sub-category of CPU Consumption or Cycle Consuming. The attack vector is classified as Remote with low complexity and requires no authentication, making it a high-risk threat for any public-facing web service that processes user-supplied text containing potential URLs.
To mitigate this vulnerability, developers should immediately upgrade anchorme to version 3.0.9 or later, where the regular expression has been optimized to prevent catastrophic backtracking through improved pattern constraints and atomic grouping techniques. For applications unable to update promptly due to dependency conflicts, alternative libraries such as url-regex-safe or validator.js can be employed for URL validation tasks that are less prone to ReDoS attacks. Additionally, implementing input length limits and timeout mechanisms on regex operations within the application layer can provide a secondary defense-in-depth strategy against similar regular expression-based denial of service attempts in other parts of the codebase.