CVE-2026-48125: faisalman ua-parser-js Uncontrolled Resource Consumption
Vulnerability summary
CVE-2026-48125 is a medium (CVSS 5.3) Uncontrolled Resource Consumption vulnerability in faisalman ua-parser-js. EPSS estimates a 0.52% chance of exploitation in the next 30 days, higher than 43.1% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 14-07-2026PublishedVulnerability first disclosed.
- 15-07-2026Last modifiedVulnerability information updated.
Description
UAParser.js is a JavaScript library to detect browsers, operating systems, CPUs, and devices from user-agent data. From 2.0.1 until 2.0.10, a regular expression denial-of-service vulnerability exists when using the Client Hints API. By sending a crafted Sec-CH-UA-Model header to an application that calls UAParser(headers).withClientHints(), an attacker can cause excessive CPU time due to catastrophic backtracking in the device regex because Client Hints values are copied without the UA_MAX_LENGTH limit used for User-Agent values. This issue is fixed in version 2.0.10.
CVSS metrics
5 scores · 5 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- OSV · DebianEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- OSV · NpmEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- NVDNIST5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
EPSS trend
Probability
0.52%
Chance of exploitation in the next 30 days
Percentile
43%
Versus all other CVEs
30-day change
+0.08 pp
From 0.45% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundUa Parser Js
Maturity: poc
Weaknesses
CWE · root cause- CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
- CWE-1333Inefficient Regular Expression ComplexityThe product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.
Affected systems
Debian1 product
- node-ua-parser-jsAll versions (No fix recorded) | < 2.0.10+ds+~cs0.3.5-1
Faisalman1 product
- ua-parser-js≥ 2.0.1, < 2.0.10
Npm1 product
- ua-parser-js≥ 2.0.1, < 2.0.10
Ua-parser-js_project1 product
- ua-parser-js≥ 2.0.1, < 2.0.10
Ubuntu1 product
- node-ua-parser-jsAll versions (No fix recorded)
5 vendors · 5 products
References
7 links- github.com/faisalman/ua-parser-js/security/advisories/GHSA-9h5v-pfqq-x599X Refsource CONFIRMREPORTWEBExploitVendor Advisory
- github.com/faisalman/ua-parser-js/commit/90354d3458495628b1d3ba68a9d76673e6d14fc5X Refsource MISCREPORTPatch
