Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 6

Export CSV
CVE-2026-48125

UAParser.js: Unbounded `Sec-CH-UA-Model` parsing can trigger ReDoS in `withClientHints()`

UAParser.js is a JavaScript library to detect browsers, operating systems, CPUs, and devices from user-agent data. From 2.0.1 until 2.0.10, a regular expression denial-of-service vulnerability exists when using the Client Hints API. By sending a crafted Sec-CH-UA-Model header to an application that calls UAParser(headers).withClientHints(), an attacker can cause excessive CPU time due to catastrophic backtracking in the device regex because Client Hints values are copied without the UA_MAX_LENGTH limit used for User-Agent values. This issue is fixed in version 2.0.10.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Faisalman Ua-parser-js Project
Products
Ua-parser-js Ua-parser-js
CVE-2021-4229

ua-parser-js Crypto Mining backdoor

A vulnerability was found in ua-parser-js 0.7.29/0.8.0/1.0.0. It has been rated as critical. This issue affects the crypto mining component which introduces a backdoor. Upgrading to version 0.7.30, 0.8.1 and 1.0.1 is able to address this issue. It is recommended to upgrade the affected component.

CVSS 3.1 · 5 Medium EPSS 1.5% KEV · Not listed
Vendors
Ua-parser-js Project
Products
Ua-parser-js
CVE-2022-25927

ua-parser-js: ReDoS vulnerability via the trim() function

Versions of the package ua-parser-js from 0.7.30 and before 0.7.33, from 0.8.1 and before 1.0.33 are vulnerable to Regular Expression Denial of Service (ReDoS) via the trim() function.

CVSS 3.1 · 5.3 Medium EPSS 1.8% KEV · Not listed
Vendors
Redhat Ua-parser-js Project
Products
Rhmt Ua-parser-js
CVE-2021-27292

nodejs-ua-parser-js: ReDoS via malicious User-Agent header

ua-parser-js >= 0.7.14, fixed in 0.7.24, uses a regular expression which is vulnerable to denial of service. If an attacker sends a malicious User-Agent header, ua-parser-js will get stuck processing it for an extended period of time.

CVSS 3.1 · 7.5 High EPSS 3.4% KEV · Not listed
Vendors
Redhat Ua-parser-js Project
Products
Acm Jaeger Logging and 2 more
CVE-2020-7793

Regular Expression Denial of Service (ReDoS)

The package ua-parser-js before 0.7.23 are vulnerable to Regular Expression Denial of Service (ReDoS) in multiple regexes (see linked commit for more info).

CVSS 3.1 · 7.5 High EPSS 3.9% KEV · Not listed
Vendors
Siemens Ua-parser-js Project
Products
Sinec Ins Ua-parser-js