ReDoS via long UserAgent header in ua-parser

Description

Affected versions of ua-parser are vulnerable to regular expression denial of service when given a specially crafted User-Agent header.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 0.3.5

References

• GHSA-pmg9-p9r2-6q87
• www.npmjs.com
• CVE-2017-16086
• CWE-400
• CAPEC-310
• OWASP 2021-A6

Related Issues

• ReDoS via long UserAgent header in useragent - CVE-2017-16030
• SvelteKit: ReDoS (O(n^2)) in content negotiation — unauthenticated DoS via the Accept header - CVE-2026-66062
• Qwik City has a CSRF Protection Bypass via Content-Type Header Validation - CVE-2026-25151
• FUXA has JWT Authentication Bypass via HTTP Referer header spoofing - CVE-2025-69985

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

ua-parser