Quick answers
- Is CVE-2021-27292 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2021-27292 being exploited in the wild.
- How severe is CVE-2021-27292?
- Low severity, with a CVSS score of 3.1, published 6 May 2021.
- Which products and versions are affected?
- ua-parser-js (npm) SEMVER:introduced=0.7.14,fixed=0.7.24.
- Is there a fix for CVE-2021-27292?
- Yes. ua-parser-js (npm): upgrade to 0.7.24 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2021-27292 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2021-27292?
- Check whether you run ua-parser-js (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- ua-parser-js (npm): upgrade to 0.7.24 or later
npm install ua-parser-js@0.7.24
Technical details
The vulnerability is a Regular Expression Denial of Service (ReDoS) condition in ua-parser-js versions 0.7.14 through 0.7.23. The vulnerable regular expression pattern exhibits catastrophic backtracking when processing certain malicious User-Agent strings, causing the parsing operation to hang for an extended period. The attack requires only network-level access to send a crafted HTTP request with a malicious User-Agent header; no authentication or user interaction is required. An attacker can leverage this to exhaust server resources and disrupt service availability. The vulnerability was fixed in version 0.7.24.
Affected products
- faisalman ua-parser-js 0.7.14 through 0.7.23
Identifiers
- CVE-2021-27292
- GHSA-78cj-fxph-m83p
Timeline
- 2021-03-17: disclosed: NVD publication date
- 2021-05-06: advisory: GHSA advisory published
- 2021-03-22: patched: Fix committed to repository (version 0.7.24)