CVE-2026-103043: falha de alta gravidade em alexcorvi anchorme
anchorme through 3.0.8 Regular Expression Denial of Service
Publicada em · Atualizada em
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.7epss 0.4%
probabilidade de exploração
0.4%top 63% das CVEs
exploração observada
nãonenhuma fonte reporta
anchorme through 3.0.8 contains a regular expression denial of service vulnerability in the IPv6 host extraction regex due to catastrophic backtracking. Attackers can supply specially crafted input strings with repeated patterns to cause exponential regex engine backtracking, blocking the Node.js event loop and denying service to other requests.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Produtos afetados
alexcorvi · anchormeReferências
https://gist.github.com/mmadersbacher/46050b4224eb979431986cdef1dd2ad3https://github.com/alexcorvi/anchorme.jshttps://github.com/alexcorvi/anchorme.js/blob/f3ae9850baa344f27b46bb149e9b891831d273b1/src/index.ts#L109https://www.npmjs.com/package/anchormehttps://www.vulncheck.com/advisories/anchorme-through-3.0.8-regular-expression-denial-of-service