npm useragent vulnerabilities

Latest npm useragent CVEs

Newest publication first

1. CVE-2020-26311 GHSL-2020-312: Regular Expression Denial of Service (ReDoS) in useragent

   Published 2024-10-26

   High·CVSS 8.7 EPSS 0.52%

   Useragent is a user agent parser for Node.js. All versions as of time of publication contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service (ReDoS). As of time of publication, no patches are available.

2. CVE-2017-16030 ReDoS via long UserAgent header in useragent

   Published 2018-06-04

   High·CVSS 7.5 EPSS 1.1%

   Useragent is used to parse useragent headers. It uses several regular expressions to accomplish this. An attacker could edit their own headers, creating an arbitrarily long useragent string, causing the event loop and server to block. This affects Useragent 2.1.12 and earlier.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.