EUVD-2026-89484
GHSA-phc2-88rx-x2mp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify endpoint passing user text to anchorme
-
DeliverySubmit crafted repeated-pattern IPv6-like string
-
ExploitRegex enters catastrophic backtracking
-
ExecutionNode.js event loop blocked
-
ImpactService denied to all clients
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V2 - Validation and Business Logic Regex complexity limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that a target application actually invokes anchorme (<=3.0.8) on attacker-controllable input AND that the input reaches the vulnerable IPv6 host-extraction regex. The most impactful deployment is server-side use on Node.js, where the single-threaded event loop means one malicious string can degrade the entire process for all users; client-side/browser use only degrades the individual attacker's own tab and is not a service-wide DoS. No authentication (PR:N) or user interaction (UI:N) is needed. Limiting factors: the library must be used with untrusted input, the specific IPv6 extraction path must be exercised, and severity in practice hinges on whether it runs on a shared server process versus per-client browser context. |
| Impact | This is a genuine but bounded availability risk. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VA:H, all confidentiality/integrity metrics N) correctly characterizes a pure denial-of-service flaw: remotely reachable, low complexity, no authentication or user interaction, with impact limited entirely to availability. The 8.7 score is driven solely by VA:H against a network-reachable, unauthenticated path. No EPSS score was provided, there is NO CISA KEV listing, and no vendor-confirmed public exploit is asserted in the input - though one reference is a GitHub gist (mmadersbacher) that likely contains reproduction/PoC details; this is inferred, not confirmed. No SSVC decision data was supplied. The realistic priority is moderate: ReDoS in a widely-used JavaScript link-detection library is credible and cheap to trigger, but actual impact depends entirely on whether an application feeds untrusted input through anchorme on a single-threaded Node.js server and whether the vulnerable IPv6 host-extraction code path is exercised. This is a real issue to patch, not a mislabeled high-CVSS non-event, but it is availability-only with no code execution or data exposure. |
| Exploit ScenarioDerived | An application uses anchorme (<=3.0.8) server-side to auto-linkify user-submitted text (e.g. comments, chat messages, profile fields) on a Node.js backend. An attacker submits a crafted string with repeated patterns matching the IPv6 host-extraction regex, causing exponential backtracking that pins the CPU and blocks the single-threaded event loop, stalling all concurrent requests. A referenced GitHub gist appears to document reproduction, so a working trigger string is likely publicly derivable. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 29, 2026
Regular expression denial of service in anchorme (published as anchorme.js on npm) through version 3.0.8 lets unauthenticated remote attackers stall a Node.js process by supplying crafted strings with repeated patterns that drive catastrophic backtracking in the IPv6 host-extraction regex. The vendor-supplied CVSS 4.0 score is 8.7, while the independent assessment scores it CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), reflecting a pure availability impact that is most severe in server-side deployments where the single-threaded event loop is shared across users; browser-side use only degrades the attacker's own tab. No CISA KEV entry or public exploit code was identified at time of analysis, and the practical severity hinges on whether anchorme is invoked on untrusted input in a shared server process.
RemediationAI
No vendor-released patch identified at time of analysis and no fixed version is recorded in the CPE, so teams should monitor https://github.com/alexcorvi/anchorme.js and https://www.vulncheck.com/advisories/anchorme-through-3.0.8-regular-expression-denial-of-service for an updated release and pin to a patched version as soon as one is published. Until then, the most direct compensating control is to keep attacker-controlled strings away from the IPv6 host-extraction regex: enforce a conservative maximum input length before calling anchorme (trade-off: legitimate long text or URLs may be clipped and not fully linkified) and pre-filter bracket-delimited IPv6 literal candidates with many colon-separated groups (trade-off: genuine IPv6 links in that input will not be auto-linked, a functional regression). Execute anchorme in a worker thread, child process, or separate bounded service with a hard execution timeout so a pathological match can be terminated instead of blocking the main event loop (trade-off: added latency, memory use, and serialization overhead for the processed text). If IPv6 linkification is not a requirement, replace anchorme with an actively maintained linkification library or a non-backtracking URL matcher (trade-off: migration effort and possible differences in link detection). Edge rate limiting and request timeouts are only residual safeguards, because a single crafted request can still stall the process, so they should not be treated as removing the underlying backtracking condition.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CVE-2026-103043 is a CWE-1333 inefficient-regular-expression-complexity flaw in anchorme, a JavaScript URL-linkification library (npm package 'anchorme', repository alexcorvi/anchorme.js). The vulnerable logic is the regex that extracts IPv6 host portions of candidate URLs, located at src/index.ts line 109 of commit f3ae9850baa344f27b46bb149e9b891831d273b1; the pattern's ambiguous, nested quantifiers are susceptible to catastrophic backtracking, so an input containing many repeated colon-separated groups or unbalanced bracket constructs forces the JavaScript engine to explore an exponential number of backtracking paths instead of failing fast. Because Node.js executes JavaScript on a single cooperative event loop, one such match monopolizes the thread and prevents the process from servicing other requests. The CPE cpe:2.3:a:alexcorvi:anchorme:*:*:*:*:*:*:*:* uses a wildcard version, meaning the catalogued component is the anchorme package with no fixed version recorded, consistent with the advisory's statement that all releases through 3.0.8 are affected. Exploitation requires an application that actually passes attacker-controllable text to anchorme and that exercises the vulnerable IPv6 extraction path; no authentication (PR:N) or user interaction (UI:N) is needed per the assessed vector, though authentication requirements are not confirmed by the provided description text alone.
Know when Anchorme gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Remote unauthenticated crafted input with no interaction (AV:N/AC:L/PR:N/UI:N); pure ReDoS so C:N/I:N and A:H, no scope change.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
anchorme through 3.0.8 contains a regular expression denial of service vulnerability in the IPv6 host extraction regex due to catastrophic backtracking. Attackers can supply specially crafted input strings with repeated patterns to cause exponential regex engine backtracking, blocking the Node.js event loop and denying service to other requests.
Executive ViewAI
anchorme.js through version 3.0.8 poses a high-severity availability risk for server-side Node.js applications that process untrusted strings, allowing unauthenticated attackers to stall shared processes and disrupt service for all users on an affected instance. Leadership should prioritize this because a single crafted input can degrade or halt critical services, even though no public exploit identified at time of analysis.
No vendor-released patch identified at time of analysis. Interim mitigations: avoid invoking anchorme.js <=3.0.8 on untrusted input, enforce strict input length and character limits, run parsing in an isolated worker/process with CPU and timeout limits, apply rate limiting, replace anchorme with a safe alternative or disable IPv6 host extraction where feasible, and monitor Node.js event-loop latency for stalls.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB