Inefficient Regular Expression Complexity in Zod jsVideoUrlParser Library
CVE-2026-5986

6.9MEDIUM

Key Information:

Vendor: Zod
Status: Jsvideourlparser
Vendor: CVE Published:; 9 April 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-5986?

A vulnerability has been detected in the Zod jsVideoUrlParser library, specifically affecting the function 'getTime' in lib/util.js. This flaw arises from the manipulation of the timestamp argument, leading to inefficient regular expression complexity during execution. Such a condition makes the system susceptible to remote attacks, allowing malicious actors to exploit this weakness. Despite an early report to the development team regarding the issue, no action has been taken as of yet, raising concerns over the vulnerability's potential for abuse in real-world scenarios.

Affected Version(s)

jsVideoUrlParser 0.5.0

jsVideoUrlParser 0.5.1

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-5986 - Proof of Concept