Asymmetric denial of service In ua-parser-js
Description
Regular Expression Denial of Service (ReDoS) in ua-parser-js ua-parser-js >= 0.7.14, fixed in 0.7.24, uses a regular expression which is vulnerable to denial of service. If an attacker sends a malicious User-Agent header, ua-parser-js will get stuck processing it for an extended period of time.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component | Affected version | Patched versions |
|---|---|---|---|
 debian 12 | 0.7.24+ds-1 | ||
debian 14 | 0.7.24+ds-1 | ||
debian 13 | 0.7.24+ds-1 | ||
 npm | 0.7.24 |
Aliases
1. 2. 3. 4. 5. 6.
References
1. 2. 3.