PT-2026-31820 · Unknown · Zod Jsvideourlparser

Ybdesire · Published 2026-04-09 · Updated 2026-04-10 · CVE-2026-5986

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Zod jsVideoUrlParser versions up to 0.5.1

Description A weakness exists in Zod jsVideoUrlParser up to version 0.5.1. The issue is related to inefficient regular expression complexity caused by manipulation of the timestamp argument within the getTime function in the lib/util.js library. This can be initiated remotely. The exploit is publicly available.

Recommendations Update to a version beyond 0.5.1.

Exploit

Fix

Resource Exhaustion

DoS

Weakness Enumeration

CWE-400

CWE-1333

Related Identifiers

CVE-2026-5986

GHSA-8FGX-WGVR-PCX8

Affected Products

Zod Jsvideourlparser

References · 10

• 🔥 https://github.com/Zod-/jsVideoUrlParser/issues/121#issue-4159661957 · Exploit
• https://osv.dev/vulnerability/GHSA-8fgx-wgvr-pcx8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-5986 · Security Note
• https://github.com/Zod-/jsVideoUrlParser/issues/121 · Note
• https://github.com/Zod-/jsVideoUrlParser · Note
• https://twitter.com/infoflowcloud/status/2042389924448436484 · Twitter Post
• https://twitter.com/CVEnew/status/2042387943499952273 · Twitter Post
• https://vuldb.com/submit/791911 · Note
• https://vuldb.com/vuln/356540/cti · Note
• https://vuldb.com/vuln/356540 · Note