Skip to main content
cve.nowby Sazabi
← npm
npmPackage

ua-parser-js

6 known vulnerabilities (2 high, 3 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
6 · 2 high, 3 medium
Registry
npm

Advisories 6

  • CVE-2026-48125Medium 5.3

    UAParser.js: Unbounded `Sec-CH-UA-Model` parsing can trigger ReDoS in `withClientHints()`

    Affected: from 2.0.1, fixed in 2.0.10.

  • CVE-2022-25927Medium 5.3

    Versions of the package ua-parser-js from 0.7.30 and before 0.7.33, from 0.8.1 and before 1.0.33 are vulnerable to Regular Expression…

    Affected: from 0.7.30, fixed in 0.7.33; from 0.8.0, fixed in 1.0.33.

  • CVE-2021-4229Medium 5.0

    ua-parser-js Crypto Mining backdoor

    Affected: from 0.7.29, fixed in 0.7.30; from 0.8.0, fixed in 0.8.1; from 1.0.0, fixed in 1.0.1.

  • ua-parser-js >= 0.7.14, fixed in 0.7.24, uses a regular expression which is vulnerable to denial of service.

    Affected: from 0.7.14, fixed in 0.7.24.

  • Regular Expression Denial of Service (ReDoS)

    Affected: fixed in 0.7.23.

  • Regular Expression Denial of Service (ReDoS)

    Affected: fixed in 0.7.22.