# CVE-2022-25927: ua-parser-js regular expression denial of service

Source: https://junglewise.ai/threats/cve-2022-25927-ua-parser-js-regular-expression-denial-of-service  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2023-01-24. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2022-25927 · Severity: low · CVSS 3.1 · Published 2023-01-24

ua-parser-js is a JavaScript library that parses user-agent strings to identify browsers and devices. A regular expression flaw allows attackers to craft specially-patterned, extremely long user-agent strings that cause the parser to hang indefinitely, effectively disabling any application that relies on it for parsing user-agent data. This can result in application unavailability and degraded user experience.

Technologies: [ua-parser-js (npm)](https://junglewise.ai/threats/technologies/ua-parser-js). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2022-25927 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2022-25927 being exploited in the wild.

**How severe is CVE-2022-25927?** Low severity, with a CVSS score of 3.1, published 24 January 2023.

**Which products and versions are affected?** ua-parser-js (npm) SEMVER:introduced=0.7.30,fixed=0.7.33.

**Is there a fix for CVE-2022-25927?** Yes. ua-parser-js (npm): upgrade to 0.7.33 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2022-25927 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2022-25927?** Check whether you run ua-parser-js (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- ua-parser-js (npm): upgrade to 0.7.33 or later

  ```sh
  npm install ua-parser-js@0.7.33
  ```


## Technical details

A regular expression denial of service (ReDoS) vulnerability exists in ua-parser-js versions 0.7.30–0.7.32 and 0.8.0–1.0.32. The vulnerability bypasses the library's MAX_LENGTH input validation due to an inefficient regular expression (CWE-1333) that exhibits exponential worst-case complexity. An attacker can send a specially crafted user-agent string with a specific pattern that triggers catastrophic backtracking in the regex engine, consuming excessive CPU and causing the application to hang. The attack vector is network-based with no authentication or user interaction required. Patches are available in versions 0.7.33 and 1.0.33, which remove the vulnerable regular expression.

## Affected products

- faisalman ua-parser-js 0.7.30 to before 0.7.33, 0.8.0 to before 1.0.33

## Identifiers

- CVE-2022-25927
- GHSA-fhg7-m89q-25r3

## Timeline

- 2023-01-24: disclosed
- 2023-01-24: patched: Patches released for versions 0.7.33 and 1.0.33

## References

- [https://github.com/faisalman/ua-parser-js/security/advisories/GHSA-fhg7-m89q-25r3](https://github.com/faisalman/ua-parser-js/security/advisories/GHSA-fhg7-m89q-25r3)

## Related threats

- [faisalman UAParser.js ReDoS in withClientHints](https://junglewise.ai/threats/cve-2026-48125-faisalman-uaparser-js-redos-in-withclienthints)
- [ua-parser-js Regular Expression Denial of Service](https://junglewise.ai/threats/cve-2020-7793-ua-parser-js-regular-expression-denial-of-service)
- [ua-parser-js embedded malware in npm package](https://junglewise.ai/threats/cve-2021-4229-ua-parser-js-embedded-malware-in-npm-package)
- [ua-parser-js regular expression denial of service](https://junglewise.ai/threats/cve-2020-7733-ua-parser-js-regular-expression-denial-of-service)
- [ua-parser-js Regular Expression Denial of Service](https://junglewise.ai/threats/cve-2021-27292-ua-parser-js-regular-expression-denial-of-service)