CVE-2021-27292: ua-parser-js_project ua-parser-js
Vulnerability summary
CVE-2021-27292 is a high (CVSS 7.5) vulnerability in ua-parser-js_project ua-parser-js. EPSS estimates a 3.37% chance of exploitation in the next 30 days, higher than 88.5% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 17-03-2021PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
ua-parser-js >= 0.7.14, fixed in 0.7.24, uses a regular expression which is vulnerable to denial of service. If an attacker sends a malicious User-Agent header, ua-parser-js will get stuck processing it for an extended period of time.
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · NpmEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
3.37%
Chance of exploitation in the next 30 days
Percentile
89%
Versus all other CVEs
30-day change
0.00 pp
From 3.37% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 found6941D80D6B4E694Df4Bc269493B7Be76
Maturity: poc
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Debian1 product
- node-ua-parser-js< 0.7.24+ds-1
Npm1 product
- ua-parser-js≥ 0.7.14, < 0.7.24
Ua-parser-js_project1 product
- ua-parser-js≥ 0.7.14, < 0.7.24
Ubuntu1 product
- node-ua-parser-jsAll versions (No fix recorded)
4 vendors · 4 products
References
7 links- github.com/pygments/pygments/commit/2e7e8c4a7b318f4032493773732754e418279a14X Refsource MISCREPORTWEBPatchThird Party Advisory
- gist.github.com/b-c-ds/6941d80d6b4e694df4bc269493b7be76X Refsource MISCREPORTWEBExploitThird Party Advisory
- github.com/faisalman/ua-parser-js/commit/809439e20e273ce0d25c1d04e111dcf6011eb566X Refsource MISCWEBPatchThird Party Advisory
