PT-2026-38448 · Npm · Youtube-Regex

Published 2026-05-07 · Updated 2026-05-07 · CVE-2025-65122

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions youtube-regex versions prior to 1.0.6

Description A Regular Expression Denial of Service (ReDoS) exists in the youtube-regex npm package. This occurs when a regular expression is processed in a way that causes excessive resource consumption, potentially leading to a denial of service.

Recommendations Update to a version later than 1.0.5.

Exploit

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2025-65122

GHSA-VPXX-H23G-GXH2

Affected Products

Youtube-Regex

References · 5

• 🔥 https://github.com/regexhq/youtube-regex/issues/14 · Exploit
• https://osv.dev/vulnerability/GHSA-vpxx-h23g-gxh2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-65122 · Security Note
• https://github.com/regexhq/youtube-regex · Note
• https://gist.github.com/6en6ar/66ef99397068c0a5e0d963bc47d7172c · Note