{"id":"CVE-2022-25927","aliases":["GHSA-fhg7-m89q-25r3"],"url":"https://o3.security/vulnerability/CVE-2022-25927","summary":"ReDoS Vulnerability in ua-parser-js version","details":"### Description:\nA regular expression denial of service (ReDoS) vulnerability has been discovered in `ua-parser-js`.\n\n### Impact:\nThis vulnerability bypass the library's `MAX_LENGTH` input limit prevention. By crafting a very-very-long user-agent string with specific pattern, an attacker can turn the script to get stuck processing for a very long time which results in a denial of service (DoS) condition.\n\n### Affected Versions:\nFrom version `0.7.30` to before versions `0.7.33` / `1.0.33`.\n\n### Patches:\nA patch has been released to remove the vulnerable regular expression, update to version `0.7.33` / `1.0.33` or later.\n\n### References:\n[Regular expression Denial of Service - ReDoS](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS)\n\n### Credits:\nThanks to @Snyk who first reported the issue.","published":"2023-01-25T05:00:00.897Z","modified":"2026-08-12T03:51:46.928344887Z","cvss":{"score":5.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P"},"epss":null,"cisaKev":null,"exploitsKnown":1,"affectedPackages":[{"ecosystem":"npm","name":"ua-parser-js","fixedVersion":"0.7.33"},{"ecosystem":"npm","name":"ua-parser-js","fixedVersion":"1.0.33"}],"fix":{"url":"https://github.com/faisalman/ua-parser-js/commit/a6140a17dd0300a35cfc9cff999545f267889411","label":"faisalman/ua-parser-js@a6140a1"},"references":[{"type":"WEB","url":"https://security.snyk.io/vuln/SNYK-JS-UAPARSERJS-3244450"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/25xxx/CVE-2022-25927.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25927"},{"type":"FIX","url":"https://github.com/faisalman/ua-parser-js/commit/a6140a17dd0300a35cfc9cff999545f267889411"},{"type":"WEB","url":"https://github.com/faisalman/ua-parser-js/security/advisories/GHSA-fhg7-m89q-25r3"},{"type":"PACKAGE","url":"https://github.com/faisalman/ua-parser-js"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:46.928344887Z"}}