Search

Find a vulnerability

Search criteria

    2 vulnerabilities by alexcorvi

    CVE-2026-103043 (GCVE-0-2026-103043)

    Vulnerability from nvd – Published: 2026-09-29 22:51 – Updated: 2026-09-29 22:51
    VLAI
    Title
    anchorme through 3.0.8 Regular Expression Denial of Service
    Summary
    anchorme through 3.0.8 contains a regular expression denial of service vulnerability in the IPv6 host extraction regex due to catastrophic backtracking. Attackers can supply specially crafted input strings with repeated patterns to cause exponential regex engine backtracking, blocking the Node.js event loop and denying service to other requests.
    Severity
    8.7 (High)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
    7.5 (High)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
    CWE
    • CWE-1333 - Inefficient Regular Expression Complexity
    Assigner
    References
    Impacted products
    Vendor Product Version
    alexcorvi anchorme Affected: 0 , ≤ 3.0.8 (semver)
        cpe:2.3:a:anchorme_project:anchorme:*:*:*:*:*:*:*:*
    		Create a notification for this product.
    Date Public
    2026-09-29 00:00
    Credits
    Mario Madersbacher
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "anchorme",
          "packageURL": "pkg:npm/anchorme",
          "product": "anchorme",
          "repo": "https://github.com/alexcorvi/anchorme.js",
          "vendor": "alexcorvi",
          "versions": [
            {
              "lessThanOrEqual": "3.0.8",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:anchorme_project:anchorme:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "3.0.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Mario Madersbacher"
        }
      ],
      "datePublic": "2026-09-29T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "anchorme through 3.0.8 contains a regular expression denial of service vulnerability in the IPv6 host extraction regex due to catastrophic backtracking. Attackers can supply specially crafted input strings with repeated patterns to cause exponential regex engine backtracking, blocking the Node.js event loop and denying service to other requests."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1333",
              "description": "Inefficient Regular Expression Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-29T22:51:02.576Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://gist.github.com/mmadersbacher/46050b4224eb979431986cdef1dd2ad3"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/alexcorvi/anchorme.js/blob/f3ae9850baa344f27b46bb149e9b891831d273b1/src/index.ts#L109"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://www.npmjs.com/package/anchorme"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/alexcorvi/anchorme.js"
        },
        {
          "name": "VulnCheck Advisory: anchorme through 3.0.8 Regular Expression Denial of Service",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/anchorme-through-3.0.8-regular-expression-denial-of-service"
        }
      ],
      "title": "anchorme through 3.0.8 Regular Expression Denial of Service",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-103043",
    "datePublished": "2026-09-29T22:51:02.576Z",
    "dateReserved": "2026-09-29T22:17:06.983Z",
    "dateUpdated": "2026-09-29T22:51:02.576Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-103043 (GCVE-0-2026-103043)

    Vulnerability from cvelistv5 – Published: 2026-09-29 22:51 – Updated: 2026-09-29 22:51
    VLAI
    Title
    anchorme through 3.0.8 Regular Expression Denial of Service
    Summary
    anchorme through 3.0.8 contains a regular expression denial of service vulnerability in the IPv6 host extraction regex due to catastrophic backtracking. Attackers can supply specially crafted input strings with repeated patterns to cause exponential regex engine backtracking, blocking the Node.js event loop and denying service to other requests.
    Severity
    8.7 (High)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
    7.5 (High)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
    CWE
    • CWE-1333 - Inefficient Regular Expression Complexity
    Assigner
    References
    Impacted products
    Vendor Product Version
    alexcorvi anchorme Affected: 0 , ≤ 3.0.8 (semver)
        cpe:2.3:a:anchorme_project:anchorme:*:*:*:*:*:*:*:*
    		Create a notification for this product.
    Date Public
    2026-09-29 00:00
    Credits
    Mario Madersbacher
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "anchorme",
          "packageURL": "pkg:npm/anchorme",
          "product": "anchorme",
          "repo": "https://github.com/alexcorvi/anchorme.js",
          "vendor": "alexcorvi",
          "versions": [
            {
              "lessThanOrEqual": "3.0.8",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:anchorme_project:anchorme:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "3.0.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Mario Madersbacher"
        }
      ],
      "datePublic": "2026-09-29T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "anchorme through 3.0.8 contains a regular expression denial of service vulnerability in the IPv6 host extraction regex due to catastrophic backtracking. Attackers can supply specially crafted input strings with repeated patterns to cause exponential regex engine backtracking, blocking the Node.js event loop and denying service to other requests."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1333",
              "description": "Inefficient Regular Expression Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-29T22:51:02.576Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://gist.github.com/mmadersbacher/46050b4224eb979431986cdef1dd2ad3"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/alexcorvi/anchorme.js/blob/f3ae9850baa344f27b46bb149e9b891831d273b1/src/index.ts#L109"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://www.npmjs.com/package/anchorme"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/alexcorvi/anchorme.js"
        },
        {
          "name": "VulnCheck Advisory: anchorme through 3.0.8 Regular Expression Denial of Service",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/anchorme-through-3.0.8-regular-expression-denial-of-service"
        }
      ],
      "title": "anchorme through 3.0.8 Regular Expression Denial of Service",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-103043",
    "datePublished": "2026-09-29T22:51:02.576Z",
    "dateReserved": "2026-09-29T22:17:06.983Z",
    "dateUpdated": "2026-09-29T22:51:02.576Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}