CVE-2017-16030 ReDoS via long UserAgent header in useragent
HighCVSS 7.5
EPSS 1.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Useragent is used to parse useragent headers. It uses several regular expressions to accomplish this. An attacker could edit their own headers, creating an arbitrarily long useragent string, causing the event loop and server to block. This affects Useragent 2.1.12 and earlier.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| npm useragent(npm) | <= 2.1.12 | No fix listed |
| useragent project useragent | <= 2.1.12 | No fix listed |
| HackerOne useragent node module | = <=2.1.12 | No fix listed |
References
- nvd.nist.gov third-party-advisory
- github.com
- www.npmjs.com
- nodesecurity.io exploit third-party-advisory