ReDoS via long UserAgent header in useragent

Description

Affected versions of useragent are vulnerable to regular expression denial of service when an arbitrarily long User-Agent header is parsed.

Recommendation

Update the useragent package to the latest compatible version. Followings are version details:

• Affected version(s): <= 2.1.12
• Patched version(s): 2.1.13

References

• GHSA-pjmx-9xr3-82qr
• www.npmjs.com
• CVE-2017-16030
• CWE-400
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Mammoth is vulnerable to Directory Traversal - CVE-2025-11849
• Cross Site Scripting vulnerability in store2 - CVE-2024-57556
• json-logic-js Command Injection vulnerability - CVE-2021-4329
• Bootstrap Cross-site Scripting vulnerability - CVE-2016-10735

Tags:

npm

useragent