Denial of Service in uap-core

Description

Some regexes are vulnerable to regular expression denial of service (REDoS) due to overlapping capture groups. This allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to maliciously crafted long strings.

Recommendation

Update the uap-core package to the latest compatible version. Followings are version details:

• Affected version(s): < 0.11.0
• Patched version(s): 0.11.0

References

• GHSA-p4pj-mg4r-x6v4
• www.npmjs.com
• CVE-2021-21317
• CWE-1333
• CWE-400
• CAPEC-310
• OWASP 2021-A6

Related Issues

• jsPDF Denial of Service (DoS) - CVE-2025-57810
• MailDev Remote Code Execution - CVE-2024-27448
• vxe-table prototype pollution - CVE-2024-57080
• Cross-Site Scripting in jquery - CVE-2020-7656

Tags:

npm

uap-core