CVE-2020-7793: ua-parser-js Regular Expression Denial of Service vulnerability
Summary
Your scan reports ua-parser-js 0.7.22. Fixed in 0.7.23.
CVE-2020-7793: ua-parser-js Regular Expression Denial of Service vulnerability. Affects ua-parser-js versions < 0.7.23. Fixed in 0.7.23. How to fix ↓
Also tracked for
- node-ua-parser-js · Debian:11
The same CVE-2020-7793 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Background
ua-parser-js is an npm package that provides a JavaScript library for parsing user agent strings. It is commonly used to extract information about the user's browser, operating system, and device from the user agent string. The package is widely used in web development projects to enhance user experience and tailor content based on the user's device and browser capabilities. However, versions of ua-parser-js before 0.7.23 are vulnerable to a Regular Expression Denial of Service (ReDoS) attack.
Vulnerability Detail
The vulnerability in ua-parser-js arises from multiple regular expressions used in the package. These regular expressions can be exploited by an attacker to cause a denial of service (DoS) by providing a specially crafted user agent string. When the vulnerable code encounters a malicious user agent string, it enters into an inefficient matching process that can lead to excessive backtracking and consume significant CPU resources. This can result in a complete system freeze or slowdown, rendering the application unresponsive. The impact of this vulnerability is particularly severe as it can be triggered remotely without any authentication or user interaction.
How To Fix
Latest published version: 2.0.10 as of 22 Oct 2026
npm install ua-parser-js@2.0.10Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.7.23
This is the first release that contains the fix.
npm install ua-parser-js@0.7.23Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, developers can implement input validation to mitigate the risk of ReDoS attacks. This can involve limiting the length of user agent strings or using a timeout mechanism to terminate the matching process if it exceeds a certain threshold. However, it is important to note that these workarounds may not provide complete protection and upgrading to the fixed version is the recommended solution.
Conclusion
The ua-parser-js package before version 0.7.23 is vulnerable to a Regular Expression Denial of Service (ReDoS) attack. This vulnerability can be exploited remotely without authentication or user interaction, leading to a denial of service condition. To mitigate this risk, it is crucial to upgrade to version 0.7.23 or later of ua-parser-js. Developers can also implement input validation and length restrictions on user agent strings as temporary workarounds. For further assistance and support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ua-parser-js →
FAQ
ua-parser-js is an npm package that provides a JavaScript library for parsing user agent strings. It is commonly used in web development projects to extract information about the user's browser, operating system, and device.
A Regular Expression Denial of Service (ReDoS) attack is a type of denial of service attack that targets regular expression implementations. By providing a specially crafted input, an attacker can exploit inefficient regular expressions and cause the matching process to enter into excessive backtracking, leading to a significant consumption of CPU resources and potentially rendering the system unresponsive.
This vulnerability can be exploited by an attacker by providing a malicious user agent string to an application that uses ua-parser-js. When the vulnerable code encounters the malicious input, it enters into an inefficient matching process that can consume significant CPU resources, potentially leading to a denial of service condition.
The impact of this vulnerability is a denial of service (DoS) condition, where the affected application becomes unresponsive or experiences significant slowdown. This can disrupt the normal operation of the application and impact the user experience. The vulnerability can be triggered remotely without any authentication or user interaction.
To protect your application from this vulnerability, it is recommended to upgrade to version 0.7.23 or later of ua-parser-js. Additionally, implementing input validation and limiting the length of user agent strings can help mitigate the risk of ReDoS attacks.
Related vulnerabilities
Recent vulnerabilities recorded for ua-parser-js.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.