anchorme through version 3.0.8 is affected by a regular expression denial of service. This type of weakness is classified as CWE-1333. The IPv6 host extraction pattern triggers catastrophic backtracking when faced with crafted input strings that contain repeated sequences. This forces the JavaScript engine to spend an excessive amount of time enumerating possible matches, freezing the Node.js event loop and preventing the application from processing other requests, leading to service interruption.

The vulnerability exists in the anchorme.js library developed by alexcorvi, specifically in all releases up to and including version 3.0.8. Applications that incorporate this library without upgrading may be exposed.

The CVSS score of 8.7 indicates a high severity. With no exploit probability data available and the vulnerability absent from CISA’s KEV catalog, the likelihood of widespread exploitation remains uncertain. However, the vulnerability can be triggered by supplying crafted URLs or input strings processed by the library, enabling an attacker to execute a denial‑of‑service attack; it is inferred that the attack could occur in remote or local contexts depending on the exposure surface of the host application.