CVE-2021-27292: Regular Expression Denial of Service (ReDoS) in ua-parser-js
Summary
CVE-2021-27292: Regular Expression Denial of Service (ReDoS) in ua-parser-js. Affects ua-parser-js versions >= 0.7.14, < 0.7.24. Fixed in 0.7.24. How to fix ↓
Also tracked for
- node-ua-parser-js · Debian:11
The same CVE-2021-27292 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ua-parser-js is an npm package that provides user agent parsing functionality. It is used to extract information about the user agent from the User-Agent header in HTTP requests. ua-parser-js version 0.7.14 and above are affected by a Regular Expression Denial of Service (ReDoS) vulnerability. This vulnerability allows an attacker to send a malicious User-Agent header, causing ua-parser-js to get stuck processing it for an extended period of time.
Vulnerability Detail
The vulnerability in ua-parser-js arises from the use of a regular expression that is susceptible to denial of service attacks. When a specially crafted User-Agent header is sent, the regular expression takes an excessive amount of time to process, leading to a denial of service condition. This can result in resource exhaustion and impact the availability of the application or system using ua-parser-js.
How To Fix
Latest published version: 2.0.10 as of 22 Oct 2026
npm install ua-parser-js@2.0.10Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.7.24
This is the first release that contains the fix.
npm install ua-parser-js@0.7.24Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
ua-parser-js versions 0.7.14 to 0.7.23 are vulnerable to a Regular Expression Denial of Service (ReDoS) attack. To mitigate this vulnerability, it is crucial to update ua-parser-js to version 0.7.24 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ua-parser-js →
FAQ
ua-parser-js is an npm package that provides user agent parsing functionality. It is commonly used in web applications to extract information about the user agent from the User-Agent header in HTTP requests.
A Regular Expression Denial of Service (ReDoS) vulnerability occurs when a regular expression takes an excessive amount of time to process certain inputs. This can be exploited by an attacker to cause a denial of service condition, impacting the availability of the application or system.
An attacker can exploit the vulnerability by sending a specially crafted User-Agent header to the application or system using ua-parser-js. This header triggers the vulnerable regular expression, causing it to take an excessive amount of time to process and leading to a denial of service condition.
The vulnerability can result in resource exhaustion and impact the availability of the application or system. An attacker can repeatedly send malicious User-Agent headers, causing the application or system to become unresponsive or crash.
To protect your application or system, it is recommended to update ua-parser-js to version 0.7.24 or later. This will ensure that the vulnerable regular expression is no longer used and mitigate the risk of a denial of service attack.
References
Related vulnerabilities
Recent vulnerabilities recorded for ua-parser-js.
