Zod jsVideoUrlParser vulnerable to ReDoS in util.js

Description

A weakness has been identified in Zod jsVideoUrlParser up to 0.5.1. The impacted element is the function getTime in the library lib/util.js. This manipulation of the argument timestamp causes inefficient regular expression complexity. It is possible to initiate the attack remotely.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 0.5.1

References

• GHSA-8fgx-wgvr-pcx8
• vuldb.com
• CVE-2026-5986
• CWE-400
• CAPEC-310
• OWASP 2021-A6

Related Issues

• LiquidJS Vulnerable to ReDoS via Quadratic Backtracking in `strip_html` Filter Regex - CVE-2026-45617
• axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge - CVE-2026-44495
• Cube Core is vulnerable to Denial of Service (DoS) via crafted request - CVE-2026-25957
• React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint - CVE-2026-42342

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

js-video-url-parser