| शीर्षक | Zod- jsVideoUrlParser 0.1.3 to 0.5.1 Inefficient Regular Expression Complexity |
|---|
| विवरण | A Regular Expression Denial of Service (ReDoS) vulnerability exists through version 0.1.3 to 0.5.1. The getTime() function in lib/util.js (line 97) uses the regular expression /^(\d+[smhdw]?)+$/ to validate timestamp parameters parsed from video URLs. Due to nested quantifiers in the pattern, a crafted string consisting of a long sequence of digits followed by a single non-matching character causes catastrophic backtracking with O(2^n) time complexity. An unauthenticated remote attacker can trigger this condition by supplying a malicious t or start URL parameter to any application that calls urlParser.parse(), causing the Node.js event loop to block for several seconds per request and resulting in denial of service.
more details: https://github.com/Zod-/jsVideoUrlParser/issues/121 |
|---|
| स्रोत | ⚠️ https://github.com/Zod-/jsVideoUrlParser/issues/121 |
|---|
| उपयोगकर्ता | ybdesire (UID 83239) |
|---|
| सबमिशन | 28/03/2026 01:28 PM (6 महीनों पहले) |
|---|
| संयम | 09/04/2026 02:23 PM (12 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 356540 [Zod jsVideoUrlParser तक 0.5.1 lib/util.js getTime timestamp सेवा अस्वीकार] |
|---|
| अंक | 20 |
|---|