Executive brief
The youtube-regex library, a tool used by developers to identify YouTube URLs in text, is vulnerable to a denial-of-service attack. By providing a specially crafted, long string of text, an attacker can cause the application to consume excessive CPU resources. This can lead to the application becoming unresponsive or crashing, potentially disrupting services for all users.
Technical details
A Regular Expression Denial of Service (ReDoS) vulnerability exists in the youtube-regex npm package through version 1.0.5. The vulnerability is located in the regular expression defined on line 11 of index.js, which suffers from catastrophic backtracking when processing large inputs containing repeated patterns like 'watch?-'. An attacker can exploit this by submitting a long, malicious string to any application function that utilizes this regex (such as .test()), leading to high CPU consumption and service unavailability. As of the advisory date, no patched version has been released.
Affected products
- regexhq youtube-regex <= 1.0.5
Timeline
- 2025-10-12: other: Issue first reported on GitHub
- 2026-05-06: disclosed: Public disclosure via Gist
- 2026-05-07: advisory: GitHub Advisory published