Regular Expression Denial-of-Service in UAParser.js Library by Faisalman

CVE-2026-48125

What is CVE-2026-48125?

The UAParser.js library, which is responsible for detecting user-agent data such as browsers and devices, is susceptible to a regular expression denial-of-service vulnerability. When using the Client Hints API with versions 2.0.1 to 2.0.9, attackers can exploit this vulnerability by sending a specially crafted Sec-CH-UA-Model header. This leads to excessive CPU consumption due to catastrophic backtracking in the regex handling, as the Client Hints inputs do not adhere to the UA_MAX_LENGTH limitation that is enforced for regular User-Agent values. The vulnerability has been addressed in version 2.0.10 of the library.

References