CVE-2022-25927: ReDoS Vulnerability in ua-parser-js
Summary
CVE-2022-25927: ReDoS Vulnerability in ua-parser-js version. Affects ua-parser-js across 2 version ranges.
< 0.7.33
>= 0.8.0, < 1.0.33
Fixed in 0.7.33 or 1.0.33, depending on the release line you run. How to fix ↓
Also tracked for
- node-ua-parser-js · Debian:11
The same CVE-2022-25927 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ua-parser-js is an open-source library used for parsing user-agent strings in JavaScript. It provides a way to extract information about the user's browser, operating system, and device from the user-agent string. This library is commonly used in web applications to customize the user experience based on the user's device and browser capabilities. However, versions of ua-parser-js prior to 0.7.33 / 1.0.33 are vulnerable to a regular expression denial of service (ReDoS) attack.
Vulnerability Detail
The ReDoS vulnerability in ua-parser-js allows an attacker to craft a malicious user-agent string with a specific pattern that can cause the library to enter into an infinite loop, consuming excessive CPU resources and resulting in a denial of service (DoS) condition. This vulnerability bypasses the library's input limit prevention mechanism, allowing an attacker to exploit it by sending a very long user-agent string. The impact of this vulnerability is a prolonged processing time, potentially leading to a complete unresponsiveness of the affected application.
How To Fix
Latest published version: 2.0.10 as of 22 Oct 2026
npm install ua-parser-js@2.0.10Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 0.7.330.7.33npm install ua-parser-js@0.7.33 -
>= 0.8.0, < 1.0.331.0.33npm install ua-parser-js@1.0.33
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If updating ua-parser-js is not immediately feasible, a temporary workaround can be implemented by implementing input validation and limiting the length of the user-agent string processed by the library. This can be done by truncating or rejecting excessively long user-agent strings before passing them to ua-parser-js. However, this workaround may impact the accuracy of the parsed user-agent information.
Conclusion
The ReDoS vulnerability in ua-parser-js can be mitigated by updating the library to version 0.7.33 or 1.0.33 or later. It is important to promptly apply the patch to ensure the proper functioning of the user-agent parsing functionality and prevent potential denial of service attacks. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for ua-parser-js →
FAQ
ua-parser-js is an open-source library used for parsing user-agent strings in JavaScript. It provides a way to extract information about the user's browser, operating system, and device from the user-agent string.
A ReDoS vulnerability, short for regular expression denial of service, occurs when a regular expression pattern can be exploited to cause the matching algorithm to enter into an infinite loop, resulting in excessive CPU usage and a denial of service condition.
The impact of this vulnerability is a prolonged processing time and potential unresponsiveness of the affected application. An attacker can exploit this vulnerability by sending a specially crafted user-agent string, causing the ua-parser-js library to consume excessive CPU resources.
To fix this vulnerability, update ua-parser-js to version 0.7.33 or 1.0.33 or later. These versions include a patch that removes the vulnerable regular expression.
If immediate updating of ua-parser-js is not possible, a temporary workaround is to implement input validation and limit the length of the user-agent string processed by the library. However, this workaround may affect the accuracy of the parsed user-agent information.
References
Related vulnerabilities
Recent vulnerabilities recorded for ua-parser-js.
