CVE-2025-65122 regexhq CVE debrief

Who should care

Defenders responsible for managing npm packages in their inventory, especially those using the youtube-regex package, should be aware of this vulnerability and assess their exposure.

Why it matters

CVE-2025-65122 is a Regex Denial of Service vulnerability in the youtube-regex npm package that can lead to a denial of service. Defenders should verify their inventory for vulnerable versions and assess potential impact.

• Potential denial of service via crafted regular expressions.
• Need to verify inventory for vulnerable youtube-regex package versions.
• Possible impact on system availability and reliability.

Technical summary

The youtube-regex npm package through version 1.0.5 is vulnerable to a Regex Denial of Service attack. This vulnerability, CVE-2025-65122, can be exploited via a specially crafted regular expression, potentially leading to a denial of service. Affected product deployments should be confirmed in managed environments, and owners should be assigned for follow-up. The vulnerability's impact on system availability and reliability should be assessed, and compensating controls should be reviewed for exposed systems while remediation is scheduled and verified.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their inventory, especially if they use the affected youtube-regex package, and assess the potential impact on their systems.

Recommended defensive actions

• Verify the presence of the youtube-regex package in your inventory and check if version 1.0.5 or earlier is in use.
• Assess the potential impact of a denial of service vulnerability on your systems, especially if they rely on the youtube-regex package.
• Consider updating the youtube-regex package to a version that is not vulnerable, if available.

Evidence notes

The CVE record and NVD detail page provide information on the vulnerability, including its CVSS score and severity. However, the exact versions affected and the specific conditions for exploitation are not detailed in the provided sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.