Regular Expression Denial of Service in Anchorme by Alex Corvi

CVE-2026-103043

What is CVE-2026-103043?

Anchorme, a library maintained by Alex Corvi, has a vulnerability where the IPv6 host extraction regex is susceptible to a Regular Expression Denial of Service (ReDoS). This security flaw allows attackers to exploit the regex engine's catastrophic backtracking by supplying specially crafted input strings containing repeated patterns. As a result, the Node.js event loop can be blocked, leading to service denial for other incoming requests. Users of version 3.0.8 and earlier are advised to review their usage of the library to mitigate potential impacts.

References