Executive brief
UAParser.js is a popular JavaScript library used by web applications to identify a visitor's device, operating system, and browser. A security flaw in how the library handles specific device information headers allows an attacker to send a specially crafted request that consumes excessive server CPU resources. This can lead to a denial-of-service (DoS) condition, making the affected web service slow or unavailable to legitimate users.
Technical details
A Regular Expression Denial of Service (ReDoS) vulnerability exists in UAParser.js versions 2.0.1 through 2.0.9 when using the Client Hints API. The vulnerability is rooted in the `withClientHints()` method, which fails to apply the `UA_MAX_LENGTH` (500 characters) limit to values extracted from the `Sec-CH-UA-Model` header. An attacker can provide a long, crafted string that triggers catastrophic backtracking in the device detection regex (specifically the MIUI detection pattern). This results in polynomial CPU time consumption relative to the input length. The issue is resolved in version 2.0.10 by implementing input length limits and optimizing the affected regular expression.
Affected products
- faisalman ua-parser-js >= 2.0.1, < 2.0.10
Timeline
- 2026-05-21: patched: Version 2.0.10 released
- 2026-05-21: advisory: GitHub Security Advisory GHSA-9h5v-pfqq-x599 published
- 2026-07-14: disclosed: CVE-2026-48125 published to NVD