Denial of Service in uap-core when processing crafted User-Agent strings

Description

Some regexes are vulnerable to regular expression denial of service (REDoS) due to overlapping capture groups. This allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to maliciously crafted long strings.

Recommendation

Update the uap-core package to the latest compatible version. Followings are version details:

• Affected version(s): < 0.7.3
• Patched version(s): 0.7.3

References

• GHSA-cmcx-xhr8-3w9p
• CVE-2020-5243
• CWE-1333
• CWE-20
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Denial of Service in uap-core - CVE-2021-21317
• uap-core Regular Expression Denial of Service issue - CVE-2018-20164
• SvelteKit is vulnerable to denial of service and possible SSRF when using prerendering - CVE-2025-67647
• SvelteKit is vulnerable to denial of service and possible SSRF when using prerendering (GHSA-j62c-4x62-9r35) - CVE-2025-67647

Tags:

npm

uap-core