Most recent entries from all

cnvd-2018-25045

2026-10-09T20:51:21.276968+00:00

cnvd-2018-25045

EUVD-2026-178481

2026-10-09T20:51:21.277021+00:00

EUVD-2026-178481

fkie_cve-2017-16030

2026-10-09T20:51:21.277036+00:00

Useragent is used to parse useragent headers. It uses several regular expressions to accomplish this. An attacker could edit their own headers, creating an arbitrarily long useragent string, causing the event loop and server to block. This affects Useragent 2.1.12 and earlier.

GHSA-pjmx-9xr3-82qr — ReDoS via long UserAgent header in useragent

2026-10-09T20:51:21.277071+00:00

Affected: npm: useragent

Affected versions of `useragent` are vulnerable to regular expression denial of service when an arbitrarily long `User-Agent` header is parsed.

## Proof of Concept ```js var useragent = require('useragent');

var badUserAgent = 'MSIE 0.0'+Array(900000).join('0')+'XBLWP'; var request = 'GET / HTTP/1.1\r\nUser-Agent: ' + badUserAgent + '\r\n\r\n'; console.log(useragent.parse(request)); ```

## Recommendation

Update to version 2.1.13 or later.

gsd-2017-16030

2026-10-09T20:51:21.277104+00:00

gsd-2017-16030