Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
6 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
A regular expression denial-of-service (ReDoS) vulnerability has been discovered in ua-parser-js when using the Client Hints API. By sending a crafted Sec-CH-UA-Model header to an application that calls UAParser(headers).withClientHints(), an attacker can cause the parser to spend excessive CPU time due to catastrophic backtracking in the device regex: Unlike when using the User-Agent value, which has a hard limit of UAMAXLENGTH = 500, when using Client Hints, values are copied without a length limit before being passed into regex parsing. PoC Impact This vulnerability allows an unauthenticated attacker to trigger a denial-of-service condition in any server-side application that uses UAParser(headers).withClientHints(). A single request with a ~32,000-character model value can consume over 400ms of CPU time, with parsing time growing polynomially with input length. The impact is availability only, there is no confidentiality or integrity impact. Affected Versions ua-parser-js…
Recommended action: Upgrade to 2.0.10 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A regular expression denial of service (ReDoS) vulnerability has been discovered in ua-parser-js. Impact: This vulnerability bypass the library's MAXLENGTH input limit prevention. By crafting a very-very-long user-agent string with specific pattern, an attacker can turn the script to get stuck processing for a very long time which results in a denial of service (DoS) condition. Affected Versions: From version 0.7.30 to before versions 0.7.33 / 1.0.33. Patches: A patch has been released to remove the vulnerable regular expression, update to version 0.7.33 / 1.0.33 or later. References: Regular expression Denial of Service - ReDoS Credits: Thanks to @Snyk who first reported the issue.
Recommended action: Upgrade to 1.0.33 or 0.7.33 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The package ua-parser-js before 0.7.23 are vulnerable to Regular Expression Denial of Service (ReDoS) in multiple regexes (see linked commit for more info).
Recommended action: Upgrade to 0.7.23 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The npm package ua-parser-js had three versions published with malicious code. Users of affected versions (0.7.29, 0.8.0, 1.0.0) should upgrade as soon as possible and check their systems for suspicious activity. See this issue for details as they unfold. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Recommended action: Upgrade to 1.0.1, 0.8.1 or 0.7.30 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The package ua-parser-js before 0.7.22 are vulnerable to Regular Expression Denial of Service (ReDoS) via the regex for Redmi Phones and Mi Pad Tablets UA.
Recommended action: Upgrade to 0.7.22 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
ua-parser-js = 0.7.14, fixed in 0.7.24, uses a regular expression which is vulnerable to denial of service. If an attacker sends a malicious User-Agent header, ua-parser-js will get stuck processing it for an extended period of time.
Recommended action: Upgrade to 0.7.24 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.