Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

ua-parser-js: Malicious User-Agent header causes program to freeze

CVE-2021-27292 · published 5 years ago
Summary

A malicious User-Agent header can cause ua-parser-js to hang and become unresponsive. This affects ua-parser-js versions 0.7.14 and earlier. Update to version 0.7.24 or later to fix the issue.

What to do
  • Update faisalman ua-parser-js to version 0.7.24.
  • Update ua-parser-js_project ua-parser-js to version 0.7.24 or later.
Affected software
Ecosystem VendorProductAffected versions
npm faisalman ua-parser-js >= 0.7.14, < 0.7.24
Fix: upgrade to 0.7.24
– ua-parser-js_project ua-parser-js >= 0.7.14, < 0.7.24
cpe:2.3:a:ua-parser-js_project:ua-parser-js:*:*:*:*:*:node.js:*:*
Original advisory text
ua-parser-js >= 0.7.14, fixed in 0.7.24, uses a regular expression which is vulnerable to denial of service. If an attacker sends a malicious User-Agent header, ua-parser-js will get stuck processi...
ua-parser-js >= 0.7.14, fixed in 0.7.24, uses a regular expression which is vulnerable to denial of service. If an attacker sends a malicious User-Agent header, ua-parser-js will get stuck processing it for an extended period of time.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
3% chance of attack within 30 days
Type
CWE-400Uncontrolled Resource Consumption
Timeline
Published17 Mar 2021
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-78cj-fxph-m83p · GHSA
CVE-2021-27292 · NVD
Track software like this
Free during beta