Fluid Attacks Database

Description

Versions of the package ua-parser-js from 0.7.30 and before 0.7.33, from 0.8.1 and before 1.0.33 are vulnerable to Regular Expression Denial of Service (ReDoS) via the trim() function.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 12	node-ua-parser-js	>=0 <0.8.1+ds+~0.7.36-3	0.8.1+ds+~0.7.36-3
npm	ua-parser-js	>=0.7.30 <0.7.33 \|\| >=0.8.0 <1.0.33	0.7.33, 1.0.33
debian 13	node-ua-parser-js	>=0 <0.8.1+ds+~0.7.36-3	0.8.1+ds+~0.7.36-3
debian 14	node-ua-parser-js	>=0 <0.8.1+ds+~0.7.36-3	0.8.1+ds+~0.7.36-3

Aliases

1. CVE-2022-259272. NVD-2022-259273. OSV-DEBIAN-2022-259274. OSV-2022-259275. GHSA-fhg7-m89q-25r36. GCVE-2022-259277. SECURITY-TRACKER-CVE-2022-25927

References

1. https://github.com/masahiro331/cve-2022-259272. https://github.com/faisalman/ua-parser-js/security/advisories/GHSA-fhg7-m89q-25r33. https://github.com/faisalman/ua-parser-js/commit/a6140a17dd0300a35cfc9cff999545f267889411

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.