UAParser.js: Unbounded `Sec-CH-UA-Model` parsing can trigger ReDoS in `withClientHints()`

Description

A regular expression denial-of-service (ReDoS) vulnerability has been discovered in ua-parser-js when using the Client Hints API. By sending a crafted Sec-CH-UA-Model header to an application that calls UAParser(headers).withClientHints(), an attacker can cause the parser to spend excessive CPU time due to catastrophic backtracking in the device regex:

Unlike when using the User-Agent value, which has a hard limit of UA_MAX_LENGTH = 500, when using Client Hints, values are copied without a length limit before being passed into regex parsing.

Recommendation

Update the ua-parser-js package to the latest compatible version. Followings are version details:

• Affected version(s): >= 2.0.1, < 2.0.10
• Patched version(s): 2.0.10

References

• GHSA-9h5v-pfqq-x599
• CVE-2026-48125
• CWE-1333
• CWE-400
• CAPEC-310
• OWASP 2021-A6

Related Issues

• protobufjs: Text Format string map parsing can mutate returned map object prototype - CVE-2026-59876
• fast-xml-parser vulnerable to ReDOS at currency parsing - CVE-2024-41818
• @nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Re - CVE-2026-49993
• string-math's string-math.js vulnerability can cause Regex Denial of Service (ReDoS) - CVE-2025-45143

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

ua-parser-js