CVE-2021-27292: High severity Ua-parser-js Project Ua-parser-js Node.js vulnerability
A regular expression denial of service (ReDoS) vulnerability was found in the npm library ua-parser-js. If a supplied user agent matches the Noble string and contains many spaces then the regex will conduct backtracking, taking an ever increasing amount of time depending on the number of spaces supplied. An attacker can use this vulnerability to potentially craft a malicious user agent resulting in a denial of service.
Other sources
ua-parser-js >= 0.7.14, fixed in 0.7.24, uses a regular expression which is vulnerable to denial of service. If an attacker sends a malicious User-Agent header, ua-parser-js will get stuck processing it for an extended period of time.
Affected Software
Remediation
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2021-27292?
CVE-2021-27292 is a regular expression denial of service (ReDoS) vulnerability in the npm library `ua-parser-js`.
How does CVE-2021-27292 impact me?
If you are using the affected version of `ua-parser-js` and a user agent matches the `Noble` string and contains many spaces, the regular expression may take an increasingly long time to process, leading to a potential denial of service.
What is the severity of CVE-2021-27292?
CVE-2021-27292 has a severity rating of 7.5, indicating a high severity.
How can I fix CVE-2021-27292?
To fix CVE-2021-27292, update `ua-parser-js` to version 0.7.24 or higher.
Where can I find more information about CVE-2021-27292?
You can find more information about CVE-2021-27292 at the following references: [GitHub Commit](https://github.com/faisalman/ua-parser-js/commit/809439e20e273ce0d25c1d04e111dcf6011eb566), [Red Hat Solution](https://access.redhat.com/solutions/5707561)