This vulnerability in Zod jsVideoUrlParser (<= 0.5.1) involves inefficient regular expression complexity in the getTime function of lib/util.js. An attacker can remotely supply crafted input to the timestamp parameter, causing excessive processing time due to the inefficient regex. This can potentially lead to denial of service conditions. The vulnerability has a CVSS 4.0 base score of 6.9 (medium severity) with network attack vector, no privileges or user interaction required, and low impact on availability. The issue was reported early but remains unpatched as of the publication date.

The impact is primarily a potential denial of service caused by inefficient regular expression processing triggered remotely without authentication or user interaction. There is no indication of code execution, data disclosure, or privilege escalation. The exploit is publicly available, increasing the risk of attempted attacks, but no known exploitation in the wild has been reported.

No official patch or remediation is currently available from the vendor. Users should monitor the vendor's communications for updates. Until a fix is released, consider applying input validation or limiting the size and complexity of timestamp inputs to mitigate potential denial of service. Avoid exposing the vulnerable function to untrusted inputs where possible.