Ua Parser Js Project Ua Parser Js vulnerabilities

6 vulnerabilities

Known vulnerabilities in Ua Parser Js Project Ua Parser Js, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

8.8CVE-2021-4229Npmua-parser-js+2
EPSS score
1.52%
A vulnerability was found in ua-parser-js 0.7.29/0.8.0/1.0.0. It has been rated as critical. This issue affects the crypto mining component which introduces a backdoor. Upgrading to version 0.7.30, 0.8.1 and 1.0.1 is able to address this issue. It is recommended to upgrade the affected component.7.5CVE-2021-27292debiannode-ua-parser-js+3
EPSS score
3.37%
ua-parser-js >= 0.7.14, fixed in 0.7.24, uses a regular expression which is vulnerable to denial of service. If an attacker sends a malicious User-Agent header, ua-parser-js will get stuck processing it for an extended period of time.7.5CVE-2020-7793debiannode-ua-parser-js+4
EPSS score
3.92%
The package ua-parser-js before 0.7.23 are vulnerable to Regular Expression Denial of Service (ReDoS) in multiple regexes (see linked commit for more info).7.5CVE-2020-7733ubuntunode-ua-parser-js+3
EPSS score
4.48%
The package ua-parser-js before 0.7.22 are vulnerable to Regular Expression Denial of Service (ReDoS) via the regex for Redmi Phones and Mi Pad Tablets UA.7.5CVE-2022-25927debiannode-ua-parser-js+3
EPSS score
1.73%
Versions of the package ua-parser-js from 0.7.30 and before 0.7.33, from 0.8.1 and before 1.0.33 are vulnerable to Regular Expression Denial of Service (ReDoS) via the trim() function.5.3CVE-2026-48125debiannode-ua-parser-js+4
EPSS score
0.52%
UAParser.js is a JavaScript library to detect browsers, operating systems, CPUs, and devices from user-agent data. From 2.0.1 until 2.0.10, a regular expression denial-of-service vulnerability exists when using the Client Hints API. By sending a crafted Sec-CH-UA-Model header to an application that calls UAParser(headers).withClientHints(), an attacker can cause excessive CPU time due to catastrophic backtracking in the device regex because Client Hints values are copied without the UA_MAX_LENGTH limit used for User-Agent values. This issue is fixed in version 2.0.10.