CVE-2026-48125: faisalman UAParser.js ReDoS in withClientHints

CVE-2026-48125 · Severity: medium · CVSS 5.3 · Published 2026-07-14

UAParser.js is a popular JavaScript library used by web applications to identify a visitor's device, operating system, and browser. A security flaw in how the library handles specific device information headers allows an attacker to send a specially crafted request that consumes excessive server CPU resources. This can lead to a denial-of-service (DoS) condition, making the affected web service slow or unavailable to legitimate users.

Technologies: ua-parser-js (npm). Vendors: npm.

Quick answers

Is CVE-2026-48125 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-48125 being exploited in the wild.
How severe is CVE-2026-48125?
Medium severity, with a CVSS score of 5.3, published 14 July 2026.
Which products and versions are affected?
ua-parser-js (npm) >= 2.0.1, < 2.0.10, SEMVER:introduced=2.0.1,fixed=2.0.10.
Is there a fix for CVE-2026-48125?
Yes. ua-parser-js (npm): upgrade to 2.0.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48125 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-48125?
Check whether you run ua-parser-js (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • ua-parser-js (npm): upgrade to 2.0.10 or later
    npm install ua-parser-js@2.0.10

Technical details

A Regular Expression Denial of Service (ReDoS) vulnerability exists in UAParser.js versions 2.0.1 through 2.0.9 when using the Client Hints API. The vulnerability is rooted in the `withClientHints()` method, which fails to apply the `UA_MAX_LENGTH` (500 characters) limit to values extracted from the `Sec-CH-UA-Model` header. An attacker can provide a long, crafted string that triggers catastrophic backtracking in the device detection regex (specifically the MIUI detection pattern). This results in polynomial CPU time consumption relative to the input length. The issue is resolved in version 2.0.10 by implementing input length limits and optimizing the affected regular expression.

Affected products

  • faisalman ua-parser-js >= 2.0.1, < 2.0.10

Identifiers

  • CVE-2026-48125
  • GHSA-9h5v-pfqq-x599

Timeline

  • 2026-05-21: patched: Version 2.0.10 released
  • 2026-05-21: advisory: GitHub Security Advisory GHSA-9h5v-pfqq-x599 published
  • 2026-07-14: disclosed: CVE-2026-48125 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.