Critical Backdoor Vulnerability in ua-parser-js Package
Summary
GHSA-236c-vhj4-gfxg: Duplicate Advisory: Embedded malware in ua-parser-js. Affects ua-parser-js across 3 version ranges.
>= 0.7.29, < 0.7.30
>= 0.8.0, < 0.8.1
>= 1.0.0, < 1.0.1
Fixed in 0.7.30, 0.8.1 or 1.0.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ua-parser-js is a popular JavaScript library used for parsing user agent strings. It helps developers identify the browser, operating system, and device type of users visiting their applications. The library is widely utilized in web development for analytics and user experience optimization. However, certain versions of ua-parser-js have been found to contain a critical vulnerability that introduces a backdoor, allowing unauthorized access to systems using the affected versions.
Vulnerability Detail
The vulnerability in ua-parser-js arises from a crypto mining component that has been embedded within the library. This backdoor can potentially allow attackers to exploit the affected systems, leading to unauthorized access and control. The vulnerability was identified in versions 0.7.29, 0.8.0, and 1.0.0, and has been rated with a CVSS score of 8.8, indicating a high severity level. Users of these versions are at risk of having their systems compromised, which could lead to data breaches and other malicious activities.
How To Fix
Latest published version: 2.0.10 as of 22 Oct 2026
npm install ua-parser-js@2.0.10Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 0.7.29, < 0.7.300.7.30npm install ua-parser-js@0.7.30 -
>= 0.8.0, < 0.8.10.8.1npm install ua-parser-js@0.8.1 -
>= 1.0.0, < 1.0.11.0.1npm install ua-parser-js@1.0.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate upgrading is not feasible, a temporary workaround is to restrict the usage of the affected versions in your project until the upgrade can be performed. This can be done by modifying the package.json file to specify a version range that excludes the vulnerable versions.
Conclusion
The ua-parser-js package has a critical vulnerability that introduces a backdoor, affecting multiple versions. Users are strongly advised to upgrade to the patched versions to mitigate risks. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time, ensuring the security of your applications.
See every vulnerability recorded for ua-parser-js →
FAQ
The affected versions are 0.7.29, 0.8.0, and 1.0.0.
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Without requiring access to the code or installation, Vulert uses just package-lock.json to provide real-time alerts. You can also check your application using the Vulert playground at Vulert Scanner.
The vulnerability can lead to unauthorized access to systems, data breaches, and exploitation by attackers, potentially compromising sensitive information.
Yes, you can modify your package.json file to restrict the usage of the affected versions until you are able to upgrade to a secure version.
Related vulnerabilities
Recent vulnerabilities recorded for ua-parser-js.
