GHSA-78cj-fxph-m83p
Regular Expression Denial of Service (ReDoS) in ua-parser-js
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | ua-parser-js | >= 0.7.14, < 0.7.24 | 0.7.24 |
Details
As written in the advisory (Markdown source, shown as plain text).
ua-parser-js >= 0.7.14, fixed in 0.7.24, uses a regular expression which is vulnerable to denial of service. If an attacker sends a malicious User-Agent header, ua-parser-js will get stuck processing it for an extended period of time.
References
External links from the advisory. They lead to third-party sites.