This vulnerability involves inefficient regular expression complexity in the getTime function of the Zod jsVideoUrlParser library (up to version 0.5.1). By manipulating the timestamp argument, an attacker can cause excessive resource consumption due to the inefficient regex processing. The vulnerability is remotely exploitable without authentication or user interaction. Although the issue was reported early, the vendor has not issued a fix or mitigation. The CVSS 4.0 base score is 6.9 (medium severity), reflecting the network attack vector, low attack complexity, no privileges or user interaction required, and limited impact on availability.

An attacker can remotely trigger inefficient regular expression processing, potentially leading to denial of service conditions by exhausting system resources. There is no indication of data confidentiality or integrity impact. The exploit is publicly available, increasing the risk of exploitation. However, no known exploits in the wild have been reported to date.

No official fix or patch is currently available from the vendor. Users should monitor the vendor's channels for updates or patches. Until a fix is released, consider applying input validation or limiting the size and complexity of timestamp inputs to reduce the risk of triggering the vulnerability. Avoid exposing the vulnerable function to untrusted inputs where possible.