GHSA-78cj-fxph-m83pHighCVSS 7.5

Regular Expression Denial of Service (ReDoS) in ua-parser-js

Published
May 6, 2021
Last Modified
February 1, 2023

🔗 CVE IDs covered (1)

CVE-2021-27292 →

📋 Description

ua-parser-js >= 0.7.14, fixed in 0.7.24, uses a regular expression which is vulnerable to denial of service. If an attacker sends a malicious User-Agent header, ua-parser-js will get stuck processing it for an extended period of time.

🎯 Affected products1

  • npm/ua-parser-js:>= 0.7.14, < 0.7.24

🔗 References (5)