7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-65122

CVE-2025-65122: youtube-regex vulnerable to Regex Denial of Service

Regex Denial of Service in youtube-regex npm package through version 1.0.5.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-65122

CVE-2025-65122:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
youtube-regex	npm	<= 1.0.5

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Regular Expression Denial of Service (ReDoS) in the youtube-regex npm package. The GitHub issue #14 provides a clear proof-of-concept that demonstrates how a long, specially crafted string can cause significant performance degradation. By analyzing the index.js file of the regexhq/youtube-regex repository, it's evident that the youtubeRegex function is the sole function in the module. This function constructs and returns the vulnerable regular expression. The vulnerability is not in a complex logical flow but within the regex pattern itself. When methods like .test() or .exec() are called on the returned regex object with a malicious payload, the application's event loop will be blocked, leading to a denial of service. Therefore, any runtime profile during an exploit would show significant time spent within the code that executes this regular expression, which originates from the youtubeRegex function.

Vulnerable functions

youtubeRegex

index.js

The function `youtubeRegex` returns a regular expression that is vulnerable to Regular Expression Denial of Service (ReDoS). The vulnerability is caused by catastrophic backtracking in the regex when processing a specially crafted string. An attacker can provide a malicious string that causes the regex engine to take an excessive amount of time to execute, leading to a denial of service. The vulnerable part of the regex is `\S*(?:(?:\/e(?:mbed))?\/|watch\/?\?(?:\S*?&?v\=))`, where the `\S*` can cause the engine to explore a very large number of possibilities on certain inputs.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.