CVE-2026-5986

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-5986
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-5986.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-5986
Aliases
Published
2026-04-09T22:30:14.639Z
Modified
2026-07-08T07:01:49.332088408Z
Severity
  • 5.5 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
Zod jsVideoUrlParser util.js getTime redos
Details

A weakness has been identified in Zod jsVideoUrlParser up to 0.5.1. The impacted element is the function getTime in the library lib/util.js. This manipulation of the argument timestamp causes inefficient regular expression complexity. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/5xxx/CVE-2026-5986.json",
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-1333",
        "CWE-400"
    ]
}
References

Affected packages

Git / github.com/zod-/jsvideourlparser

Affected ranges

Type
GIT
Repo
https://github.com/zod-/jsvideourlparser
Events
Introduced
e1c80ca3e67d77ef408f44f767bbd4c49ddb6414
Last affected
82af884e1914885ff25e43aae585632d2626ecb9
Database specific 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "0.5.0"
        },
        {
            "last_affected": "0.5.0"
        },
        {
            "introduced": "0.5.1"
        },
        {
            "last_affected": "0.5.1"
        }
    ]
}

Affected versions

0.*
0.5.0
0.5.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-5986.json"