CVE-2026-48125 UAParser.js: Unbounded `Sec-CH-UA-Model` parsing can trigger ReDoS in `withClientHints()`
Attackers can cause excessive CPU consumption and service disruption by sending crafted headers to applications using the vulnerable UAParser.js library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-48125?
CVE-2026-48125 is a medium-severity denial of service vulnerability in faisalman ua-parser-js, published on 14 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
UAParser.js is a JavaScript library to detect browsers, operating systems, CPUs, and devices from user-agent data. From 2.0.1 until 2.0.10, a regular expression denial-of-service vulnerability exists when using the Client Hints API. By sending a crafted Sec-CH-UA-Model header to an application that calls UAParser(headers).withClientHints(), an attacker can cause excessive CPU time due to catastrophic backtracking in the device regex because Client Hints values are copied without the UA_MAX_LENGTH limit used for User-Agent values. This issue is fixed in version 2.0.10.
Which versions are affected by CVE-2026-48125?
2 open source packages ship an affected version, including ua-parser-js. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
ua-parser-js npm | From 2.0.1 | 2.0.10 |
ua-parser-js npm | From 2.0.1 | 2.0.10 |
Products include Ua-Parser-Js Project Ua-Parser-Js.
How do I fix CVE-2026-48125?
Upgrade ua-parser-js to 2.0.10 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-48125 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-48125 exists.
Other vulnerabilities in faisalman ua-parser-js
Sources
Also known as DEBIAN-CVE-2026-48125, GHSA-9h5v-pfqq-x599, MINI-jhpp-x6pj-c87x, MINI-v3vr-22m2-6c6h, UBUNTU-CVE-2026-48125.