CVE-2022-25927: High severity Ua-parser-js Project Ua-parser-js Node.js vulnerability
A flaw was found in ua-parser-js. This issue could allow a malicious user to trigger a regular expression denial of service (ReDoS) via the trim() function.
Other sources
Versions of the package ua-parser-js from 0.7.30 and before 0.7.33, from 0.8.1 and before 1.0.33 are vulnerable to Regular Expression Denial of Service (ReDoS) via the trim() function.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/ua-parser-jsto a version that resolves this vulnerability.Fixed in 0.7.33 - Upgrade
Upgrade
redhat/ua-parser-jsto a version that resolves this vulnerability.Fixed in 1.0.33 - Upgrade
Upgrade
ua-parser-jsto a version that resolves this vulnerability.Fixed in 0.7.33 - Upgrade
Upgrade
ua-parser-jsto a version that resolves this vulnerability.Fixed in 1.0.33 - Compensating control
Mitigate possible ReDoS by ensuring user-controlled inputs that reach ua-parser-js trim() handling are rate-limited and bounded in size (e.g., cap request/field length) until the package is upgraded.
Event History
Frequently Asked Questions
What is CVE-2022-25927?
CVE-2022-25927 is a vulnerability in the ua-parser-js package that allows a malicious user to trigger a regular expression denial of service (ReDoS) via the trim() function.
What software versions are affected by CVE-2022-25927?
Versions of ua-parser-js from 0.7.30 up to, but not including, 0.7.33, and versions from 0.8.1 up to, but not including, 1.0.33 are affected by CVE-2022-25927.
How severe is CVE-2022-25927?
CVE-2022-25927 has a severity score of 7.5, indicating a high severity vulnerability.
How can I fix CVE-2022-25927?
To fix CVE-2022-25927, upgrade ua-parser-js package to version 0.7.33 or higher for versions 0.7.x and to version 1.0.33 or higher for versions 0.8.x and later.
Where can I find more information about CVE-2022-25927?
You can find more information about CVE-2022-25927 on the CVE website (https://www.cve.org/CVERecord?id=CVE-2022-25927) and NIST NVD (https://nvd.nist.gov/vuln/detail/CVE-2022-25927).