GHSA-8fgx-wgvr-pcx8

Source

https://github.com/advisories/GHSA-8fgx-wgvr-pcx8

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-8fgx-wgvr-pcx8/GHSA-8fgx-wgvr-pcx8.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-8fgx-wgvr-pcx8

Aliases

CVE-2026-5986

Published

2026-04-10T00:30:31Z

Modified

2026-04-10T20:48:47.736726Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
5.5 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

Zod jsVideoUrlParser vulnerable to ReDoS in util.js

Details

A weakness has been identified in Zod jsVideoUrlParser up to 0.5.1. The impacted element is the function getTime in the library lib/util.js. This manipulation of the argument timestamp causes inefficient regular expression complexity. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Database specific

{
    "github_reviewed_at": "2026-04-10T20:34:42Z",
    "nvd_published_at": "2026-04-09T23:17:01Z",
    "cwe_ids": [
        "CWE-400"
    ],
    "severity": "MODERATE",
    "github_reviewed": true
}

References

Affected packages

npm / js-video-url-parser

Package

Name: js-video-url-parser; View open source insights on deps.dev
Purl: pkg:npm/js-video-url-parser

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Last affected

0.5.1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-8fgx-wgvr-pcx8/GHSA-8fgx-wgvr-pcx8.json"