GitHub Advisoryadvisory · npm

GHSA-8fgx-wgvr-pcx8 Zod jsVideoUrlParser vulnerable to ReDoS in util.js

MEDIUM Published 2026-04-10 Modified 2026-04-10 Official page ↗
Aliases
CVE-2026-5986
Ecosystem
npm
Packages
js-video-url-parser
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weaknesses
CWE-400
Reviewed
2026-04-10

Affected packages

• npm js-video-url-parser: <= 0.5.1 (no fix yet)

Description

A weakness has been identified in Zod jsVideoUrlParser up to 0.5.1. The impacted element is the function getTime in the library lib/util.js. This manipulation of the argument timestamp causes inefficient regular expression complexity. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Related

Alias · CVE (1)

  • CVE-2026-5986 A weakness has been identified in Zod jsVideoUrlParser up to 0.5.1. vulnerability

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References