CVE-2026-48125
published 2026-07-14CVE-2026-48125: UAParser.js is a JavaScript library to detect browsers, operating systems, CPUs, and devices from user-agent data. From 2.0.1 until 2.0.10, a regular…
PriorityP431medium5.3CVSS 3.1
AVNACLPRNUINSUCNINAL
EPSS
0.37%
29.8th percentile
UAParser.js is a JavaScript library to detect browsers, operating systems, CPUs, and devices from user-agent data. From 2.0.1 until 2.0.10, a regular expression denial-of-service vulnerability exists when using the Client Hints API. By sending a crafted Sec-CH-UA-Model header to an application that calls UAParser(headers).withClientHints(), an attacker can cause excessive CPU time due to catastrophic backtracking in the device regex because Client Hints values are copied without the UA_MAX_LENGTH limit used for User-Agent values. This issue is fixed in version 2.0.10.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| faisalman | ua-parser-js | — | — |
| gatekeeper | gatekeeper-rhel9 | — | — |
| openshift4 | ose-console | — | — |
| openshift4 | ose-console-rhel9 | — | — |
| rhceph | alloy-rhel10 | — | — |
| rhmtc | openshift-migration-ui-rhel8 | — | — |
| ua-parser-js_project | ua-parser-js | >= 2.0.1 < 2.0.10 | 2.0.10 |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
ua-parser-js: UAParser.js: Denial of Service via crafted Client Hints header
vendor_redhat·2026-07-14·CVSS 5.3
CVE-2026-48125 [MEDIUM] CWE-1333 ua-parser-js: UAParser.js: Denial of Service via crafted Client Hints header
ua-parser-js: UAParser.js: Denial of Service via crafted Client Hints header
A flaw was found in UAParser.js, a JavaScript library for detecting client information. A remote attacker can exploit this vulnerability by sending a specially crafted `Sec-CH-UA-Model` header when the application uses the Client Hints API. This can cause excessive CPU usage due to a regular expression denial-of-service (ReDoS) issue, leading to a denial of service for the affected application.
Statement: A Regular Expression Denial of Service (ReDoS) vulnerability was found in the ua-parser-js npm package. A remote attacker could send a crafted Client Hints header that causes excessive CPU consumption due to inefficient regular expression processing, leading to a denial of service condition. Red Hat ships ua-pa
GHSA
UAParser.js: Unbounded `Sec-CH-UA-Model` parsing can trigger ReDoS in `withClientHints()`
ghsa·2026-06-15
CVE-2026-48125 [MEDIUM] CWE-1333 UAParser.js: Unbounded `Sec-CH-UA-Model` parsing can trigger ReDoS in `withClientHints()`
UAParser.js: Unbounded `Sec-CH-UA-Model` parsing can trigger ReDoS in `withClientHints()`
### Summary
A regular expression denial-of-service (ReDoS) vulnerability has been discovered in `ua-parser-js` when using the Client Hints API. By sending a crafted `Sec-CH-UA-Model` header to an application that calls `UAParser(headers).withClientHints()`, an attacker can cause the parser to spend excessive CPU time due to catastrophic backtracking in the device [regex](https://github.com/faisalman/ua-parser-js/blob/2.0.9/src/main/ua-parser.js#L615):
```js
/ ([\w ]+) miui\/v?\d/i
```
Unlike when using the `User-Agent` value, which has a hard limit of `UA_MAX_LENGTH = 500`, when using Client Hints, values are copied without a length limit before being passed into regex parsing.
### PoC
```js
con
No detection rules found.
No public exploits indexed.
https://github.com/faisalman/ua-parser-js/commit/90354d3458495628b1d3ba68a9d76673e6d14fc5https://github.com/faisalman/ua-parser-js/releases/tag/2.0.10https://github.com/faisalman/ua-parser-js/security/advisories/GHSA-9h5v-pfqq-x599https://github.com/faisalman/ua-parser-js/security/advisories/GHSA-9h5v-pfqq-x599
2026-07-14
Published