ReDoS via long UserAgent header in useragent

Description

Affected versions of useragent are vulnerable to regular expression denial of service when an arbitrarily long User-Agent header is parsed.

Recommendation

Update the useragent package to the latest compatible version. Followings are version details:

• Affected version(s): <= 2.1.12
• Patched version(s): 2.1.13

References

• GHSA-pjmx-9xr3-82qr
• www.npmjs.com
• CVE-2017-16030
• CWE-400
• CAPEC-310
• OWASP 2021-A6

Related Issues

• method-override ReDoS when untrusted user input passed into X-HTTP-Method-Override header - CVE-2017-16136
• ReDoS via long string of semicolons in tough-cookie - CVE-2016-1000232
• ReDoS in Sec-Websocket-Protocol header - CVE-2021-32640
• angular vulnerable to regular expression denial of service (ReDoS) - CVE-2022-25844

Tags:

npm

useragent