CVE-2022-25927 ReDoS Vulnerability in ua-parser-js version
An attacker can cause a denial of service in applications using ua-parser-js by sending specially crafted user agent strings that trigger excessive CPU usage.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-25927?
CVE-2022-25927 is a medium-severity denial of service vulnerability in ua-parser-js, published on 25 Jan 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Versions of the package ua-parser-js from 0.7.30 and before 0.7.33, from 0.8.1 and before 1.0.33 are vulnerable to Regular Expression Denial of Service (ReDoS) via the trim() function.
Weakness: CWE-1333
Which versions are affected by CVE-2022-25927?
4 open source packages ship an affected version, including ua-parser-js. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
ua-parser-js npm | From 0.7.30 | 0.7.33 |
ua-parser-js npm | From 0.7.30 | 0.7.33 |
ua-parser-js npm | From 0.8.0 | 1.0.33 |
ua-parser-js npm | From 0.8.0 | 1.0.33 |
Products include Ua-Parser-Js Project Ua-Parser-Js.
How do I fix CVE-2022-25927?
Upgrade ua-parser-js to a fixed version for your release line: 0.7.33 or 1.0.33.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2022-25927 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-25927 exists.
Public exploit code: 2 proofs of concept on GitHub.
Other vulnerabilities in ua-parser-js
Sources
Also known as CLSA-2026-1782781179, DEBIAN-CVE-2022-25927, GHSA-fhg7-m89q-25r3, ROOT-APP-NPM-CVE-2022-25927, UBUNTU-CVE-2022-25927.