PatchFirst · Latest vulnerabilities

node-ua-parser-js vulnerabilities

Vulnerabilities published for node-ua-parser-js in the last 30 days: 0. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗

Vulnerabilities: 5

CVE-2026-48125
Medium · CVSS 5.3EPSS 0.52%No fix published
UAParser.js: Unbounded `Sec-CH-UA-Model` parsing can trigger ReDoS in `withClientHints()`
UAParser.js is a JavaScript library to detect browsers, operating systems, CPUs, and devices from user-agent data. From 2.0.1 until 2.0.10, a regular expression denial-of-service vulnerability exists when using the Client Hints API. By sending a crafted Sec-CH-UA-Model header to an application that calls UAParser(headers).withClientHints(), an attacker can cause excessive CPU time due to catastrophic backtracking in the device regex because Client Hints values are copied without the UA_MAX_LENGTH limit used for User-Agent values. This issue is fixed in version 2.0.10.
node-ua-parser-js Operating systems
Published July 14, 2026Updated July 15, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2022-25927
Medium · CVSS 5.3EPSS 1.73%No fix published
CVE-2022-25927
Versions of the package ua-parser-js from 0.7.30 and before 0.7.33, from 0.8.1 and before 1.0.33 are vulnerable to Regular Expression Denial of Service (ReDoS) via the trim() function.
node-ua-parser-js Operating systems
Published January 25, 2023Updated April 1, 2025
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2021-27292
High · CVSS 7.5EPSS 3.37%No fix published
CVE-2021-27292
ua-parser-js >= 0.7.14, fixed in 0.7.24, uses a regular expression which is vulnerable to denial of service. If an attacker sends a malicious User-Agent header, ua-parser-js will get stuck processing it for an extended period of time.
node-ua-parser-js Operating systems
Published March 17, 2021Updated August 3, 2024
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2020-7793
High · CVSS 7.5EPSS 3.92%No fix published
Regular Expression Denial of Service (ReDoS)
The package ua-parser-js before 0.7.23 are vulnerable to Regular Expression Denial of Service (ReDoS) in multiple regexes (see linked commit for more info).
node-ua-parser-js Operating systems
Published December 11, 2020Updated September 16, 2024
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2020-7733
High · CVSS 7.5EPSS 4.48%No fix published
Regular Expression Denial of Service (ReDoS)
The package ua-parser-js before 0.7.22 are vulnerable to Regular Expression Denial of Service (ReDoS) via the regex for Redmi Phones and Mi Pad Tablets UA.
node-ua-parser-js Operating systems
Published September 16, 2020Updated September 17, 2024
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →

node-ua-parser-js vulnerabilities

UAParser.js: Unbounded `Sec-CH-UA-Model` parsing can trigger ReDoS in `withClientHints()`

CVE-2022-25927

CVE-2021-27292

Regular Expression Denial of Service (ReDoS)

Regular Expression Denial of Service (ReDoS)

Check your server