A flaw in the getTime function of Zod jsVideoUrlParser allows an attacker to craft input that causes the regular expression to become computationally expensive, resulting in a denial of service. The weakness is a classic example of regular expression denial of service (CWE-1333) and uncontrolled resource consumption (CWE-400). If exploited, the application will consume excessive CPU cycles, potentially leading to degraded performance or service unavailability for legitimate users.

The vulnerability affects all installations of Zod jsVideoUrlParser up to version 0.5.1. No specific build or distribution details are provided beyond the product name and maximum affected version. Users employing this library within their codebases are at risk.

The CVSS score is 6.9, indicating moderate severity, and the vulnerability can be triggered remotely by an attacker sending specially crafted video URL timestamps to the getTime routine. EPSS data is not available, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog. The attack vector is presumed to be remote, as the function can be accessed via normal application inputs.