Description
ua-parser-js >= 0.7.14, fixed in 0.7.24, uses a regular expression which is vulnerable to denial of service. If an attacker sends a malicious User-Agent header, ua-parser-js will get stuck processing it for an extended period of time.
Recommendation
Update the ua-parser-js package to the latest compatible version. Followings are version details:
- Affected version(s): >= 0.7.14, < 0.7.24
- Patched version(s): 0.7.24
References
Could your website be exposed too?
SmartScanner can check your website for Regular Expression Denial of Service (ReDoS) in ua-parser-js and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Regular Expression Denial of Service (ReDoS) in jsx-slack - CVE-2021-43838
- Regular Expression Denial of Service (ReDOS) - color-string - CVE-2021-29060
- semver-regex Regular Expression Denial of Service (ReDOS) - CVE-2021-3795
- Regular Expression Denial of Service (ReDoS) in Prism - CVE-2021-32723
You might also like:
See something that needs correcting? Let us knowUpdated February 01, 2023