CVE-2021-27292

ua-parser-js >= 0.7.14, fixed in 0.7.24, uses a regular expression which is vulnerable to denial of service

published March 17, 2021

CVSS
—
EPSS
3%
Percentile
88.7
In the wild
Unconfirmed
What it is

ua-parser-js >= 0.7.14, fixed in 0.7.24, uses a regular expression which is vulnerable to denial of service. If an attacker sends a malicious User-Agent header, ua-parser-js will get stuck processing it for an extended period of time.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.03366 · 88.7th percentile
Published
2021-03-17T12:34Z
EPSS history
Timeline
  • 17 MAR 12:34Z
    ua-parser-js >= 0.7.14, fixed in 0.7.24, uses a regular expression which is vulnerable to denial of service
    cvelistv5