CVE-2026-103043
anchorme through 3.0.8 contains a regular expression denial of service vulnerability in the IPv6 host extraction regex due to catastrophic b
CVSS
7.5
High
EPSS
0.4%
p37
KEV
—
Exploit Today
11
0-100
Published: Sep 29, 2026 · Last modified: Oct 20, 2026 · CWE-1333
0.4%EPSS · 30 days0.4%
2026-09-302026-10-19
anchorme through 3.0.8 contains a regular expression denial of service vulnerability in the IPv6 host extraction regex due to catastrophic backtracking. Attackers can supply specially crafted input strings with repeated patterns to cause exponential regex engine backtracking, blocking the Node.js event loop and denying service to other requests.
- gist.github.comhttps://gist.github.com/R3tro16/92948206e9893a3739b91746439384ab
- gist.github.comhttps://gist.github.com/mmadersbacher/46050b4224eb979431986cdef1dd2ad3
- github.comhttps://github.com/alexcorvi/anchorme.js
- github.comhttps://github.com/alexcorvi/anchorme.js/blob/f3ae9850baa344f27b46bb149e9b891831d273b1/src/index.ts#L109
- www.npmjs.comhttps://www.npmjs.com/package/anchorme
- www.vulncheck.comhttps://www.vulncheck.com/advisories/anchorme-through-3.0.8-regular-expression-denial-of-service
- gist.github.comhttps://gist.github.com/mmadersbacher/46050b4224eb979431986cdef1dd2ad3
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-112901——
——0Pillow is a Python imaging library. Prior to 13.0.0, Pillow's XBM header parser is vulnerable to regular-expression denial of service. In XbmImageFile._open, when an application calls Image.open() on a small crafted XBM file, XbmImagePlugin applies a backtracking expression to the attacker-controlled header before image dimensions are accepted, stalling a worker for minutes and denying service. This issue is fixed in version 13.0.0.14hCVE-2026-1123005.3 MED—
——0A vulnerability was identified in DiffSK configobj up to 5.0.9. Affected by this vulnerability is the function _sectionmarker of the file configobj/__init__.py. The manipulation leads to inefficient regular expression complexity. Remote exploitation of the attack is possible. The project was informed of the problem early through an issue report but has not responded yet.14hCVE-2026-1123667.5 HIG—
——0Picomatch through 4.0.7 contains a regular expression denial of service vulnerability that allows attackers to block the event loop by supplying single-branch repeated extglob patterns. Attackers can provide globs like +(*) or +(*a), which analyzeRepeatedExtglob in lib/parse.js skips, causing exponential backtracking against short crafted strings and denying service to Node.js applications.2dCVE-2026-111997—15.7%
——5ip-address before 10.7.4 allows a denial of service (CPU consumption from quadratic complexity, and application stall) via many % characters in input reaching a function call that uses the Address6 constructor.2dCVE-2026-599665.7 MED23.4%
——7Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, executes user-controlled Automation regular-expression patterns with Python re.sub() without complexity validation or an execution timeout when an authenticated user stores a catastrophic-backtracking regex and any user in the same Space imports a matching recipe. Request processing uses Automation.param_2, apply_regex_replace_automation, sub, api/recipe-from-source/. The attack works because the shared-Space automation engine evaluates the malicious pattern during recipe import and can occupy a Gunicorn worker until its request timeout. This can exhaust application worker slots and make the service unavailable to users. This issue is fixed in version 2.6.10.2dCVE-2026-1117143.1 LOW11.5%
——3tarteaucitron.js before 1.37.0 contains a regular expression denial of service vulnerability that allows attackers to block visitor pages by supplying unescaped cookie names to cookie.purge. Attackers can plant a cookie from a sibling subdomain or inject a purgeBtn element with a catastrophic-backtracking data-cookie pattern that freezes the page when the purge button is clicked.5d