ReDoS via long UserAgent header in useragent

Description

Affected versions of useragent are vulnerable to regular expression denial of service when an arbitrarily long User-Agent header is parsed.

Recommendation

Update the useragent package to the latest compatible version. Followings are version details:

• Affected version(s): <= 2.1.12
• Patched version(s): 2.1.13

References

• GHSA-pjmx-9xr3-82qr
• www.npmjs.com
• CVE-2017-16030
• CWE-400
• CAPEC-310
• OWASP 2021-A6

Related Issues

• useragent Regular Expression Denial of Service vulnerability - CVE-2020-26311
• json-logic-js Command Injection vulnerability - CVE-2021-4329
• Bootstrap Cross-site Scripting vulnerability - CVE-2016-10735
• protobufjs Prototype Pollution vulnerability - CVE-2023-36665

Tags:

npm

useragent