The vulnerability allows an attacker to trigger a denial of service by passing specially crafted input to the youtube-regex npm package. The regex engine performs catastrophic backtracking, consuming excessive CPU and memory. This leads to application hang or crash, impacting availability of services that rely on the module.

The npm module youtube-regex, versions 1.0.5 and below, is affected. The vendor is not specified, but the package is widely used in Node.js projects that parse YouTube URLs.

The CVSS score of 7.5 indicates a moderate to high severity. The EPSS score is not available, but the vulnerability is classified as a denial‑of‑service. It is not listed in CISA KEV, so no known exploits are currently in the public literature. However, the lack of remediation guidance and the potential for resource exhaustion mean that an application that depends on this module is at moderate to high risk if the vulnerable version is in use. The attack likely requires sending crafted input to the regex function, which can be achieved by any user who can influence the input data for YouTube URL parsing.