A regular expression denial of service vulnerability in the youtube-regex npm package through version 1.0.5 allows unauthenticated attackers to cause high application unavailability.

This is a denial of service vulnerability triggered by inefficient regular expression evaluation, allowing unauthenticated remote attackers to exhaust system resources.

A successful exploitation of this vulnerability leads to complete application downtime for services relying on the affected package, impacting business operations and user availability. With a CVSS score of 7.5, the risk is rated as high due to the network attack vector and the lack of required user interaction or privileges.

Immediate Action: Review internal dependencies and restrict the use of the vulnerable package until an official fix is released by the maintainers.

Proactive Monitoring: Monitor application performance metrics and error logs for unexpected CPU spikes or unhandled exceptions related to regex evaluation.

Compensating Controls: Implement input length validation and regex execution timeouts at the application layer to mitigate potential denial of service attacks.

Public Exploit Available: No (no confirmed public exploit in available data; CISA SSVC assessment indicates a proof-of-concept).

Security teams must prioritize identifying any applications utilizing the youtube-regex package up to version 1.0.5. Given the absence of an official patch, administrators should consider removing the dependency or implementing strict input validation and resource monitoring to prevent service degradation.