Every CVE Search/ Get API key

CVE-2022-25927

ReDoS Vulnerability in ua-parser-js version

5.3 MediumPublic exploitFix available

Versions of the package ua-parser-js from 0.7.30 and before 0.7.33, from 0.8.1 and before 1.0.33 are vulnerable to Regular Expression Denial of Service (ReDoS) via the trim() function.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

1.77%Up 0.9 points since Jan 25, 2023
90%50%10%1%

What each source reports

CVE List Score used 5.3

Versions of the package ua-parser-js from 0.7.30 and before 0.7.33, from 0.8.1 and before 1.0.33 are vulnerable to Regular Expression Denial of Service (ReDoS) via the trim() function.

Record
CVE-2022-25927
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P
Weakness
CWE-1333, CWE-1333
Updated
2026-11-02
EUVDEUVD-2023-0457 5.3

Versions of the package ua-parser-js from 0.7.30 and before 0.7.33, from 0.8.1 and before 1.0.33 are vulnerable to Regular Expression Denial of Service (ReDoS) via the trim() function.

Record
EUVD-2023-0457
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P
Updated
2026-11-02
GitHub AdvisoriesGHSA-fhg7-m89q-25r3 7.5

ReDoS Vulnerability in ua-parser-js version

Description:

A regular expression denial of service (ReDoS) vulnerability has been discovered in ua-parser-js.

Impact:

This vulnerability bypass the library's MAX_LENGTH input limit prevention. By crafting a very-very-long user-agent string with specific pattern, an attacker can turn the script to get stuck processing for a very long time which results in a denial of service (DoS) condition.

Affected Versions:

From version 0.7.30 to before versions 0.7.33 / 1.0.33.

Patches:

A patch has been released to remove the vulnerable regular expression, update to version 0.7.33 / 1.0.33 or later.

References:

Regular expression Denial of Service - ReDoS

Credits:

Thanks to @Snyk who first reported the issue.

Record
GHSA-fhg7-m89q-25r3
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400, CWE-1333
Updated
2026-11-02
NVD 5.3

Versions of the package ua-parser-js from 0.7.30 and before 0.7.33, from 0.8.1 and before 1.0.33 are vulnerable to Regular Expression Denial of Service (ReDoS) via the trim() function.

Record
CVE-2022-25927
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-1333
Updated
2026-11-02
OSV 5.3

Versions of the package ua-parser-js from 0.7.30 and before 0.7.33, from 0.8.1 and before 1.0.33 are vulnerable to Regular Expression Denial of Service (ReDoS) via the trim() function.

Record
CVE-2022-25927
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P
Weakness
CWE-1333
Updated
2026-11-02
OSVDEBIAN-CVE-2022-25927 7.5

Versions of the package ua-parser-js from 0.7.30 and before 0.7.33, from 0.8.1 and before 1.0.33 are vulnerable to Regular Expression Denial of Service (ReDoS) via the trim() function.

Record
DEBIAN-CVE-2022-25927
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-03
Show 4 moreShow less
OSVGHSA-fhg7-m89q-25r3 7.5

ReDoS Vulnerability in ua-parser-js version

Description:

A regular expression denial of service (ReDoS) vulnerability has been discovered in ua-parser-js.

Impact:

This vulnerability bypass the library's MAX_LENGTH input limit prevention. By crafting a very-very-long user-agent string with specific pattern, an attacker can turn the script to get stuck processing for a very long time which results in a denial of service (DoS) condition.

Affected Versions:

From version 0.7.30 to before versions 0.7.33 / 1.0.33.

Patches:

A patch has been released to remove the vulnerable regular expression, update to version 0.7.33 / 1.0.33 or later.

References:

Regular expression Denial of Service - ReDoS

Credits:

Thanks to @Snyk who first reported the issue.

Record
GHSA-fhg7-m89q-25r3
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-1333, CWE-400
Updated
2026-11-02
OSVUBUNTU-CVE-2022-25927 5.3

Versions of the package ua-parser-js from 0.7.30 and before 0.7.33, from 0.8.1 and before 1.0.33 are vulnerable to Regular Expression Denial of Service (ReDoS) via the trim() function.

Record
UBUNTU-CVE-2022-25927
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVCLSA-2026-1782781179 No score

TuxCare security update for ua-parser-js (1 CVE)

TuxCare rebuilt ua-parser-js to address 1 CVE. Fixed in 0.7.31-tuxcare.1.

Record
CLSA-2026-1782781179
Updated
2026-11-02
OSVROOT-APP-NPM-CVE-2022-25927 No score

CVE-2022-25927 in ua-parser-js - Patched by Root

Root has patched CVE-2022-25927 in the ua-parser-js package for Root:npm. Multiple fixed versions available.

Record
ROOT-APP-NPM-CVE-2022-25927
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
ua-parser-js
npm
 0.8.0 up to 1.0.33
1.0.33
ua-parser-js
npm
 0.7.30 up to 0.7.33
0.7.33
ua-parser-js
TuxCare:npm
 0.7.31-tuxcare.0 up to 0.7.31-tuxcare.1, plus listed versions
0.7.31
0.7.31-tuxcare.1
node-ua-parser-js
Debian:12
 before 0.8.1+ds+~0.7.36-3
0.8.1+ds+~0.7.36-3
node-ua-parser-js
Debian:13
 before 0.8.1+ds+~0.7.36-3
0.8.1+ds+~0.7.36-3
node-ua-parser-js
Debian:14
 before 0.8.1+ds+~0.7.36-3
0.8.1+ds+~0.7.36-3
ua-parser-js
Root:npm
 before 0.7.31-aikido.1
0.7.31-aikido.1
@rootio/ua-parser-js
Root:npm
 before 0.7.31-root.io.1
0.7.31-root.io.1
node-ua-parser-js
Ubuntu:18.04:LTS
 All versions, plus listed versions
0.7.14-1
 None known
node-ua-parser-js
Ubuntu:20.04:LTS
 All versions, plus listed versions
0.7.14-1
 None known
Show 5 moreShow less
Affected packages
PackageAffectedFixed
node-ua-parser-js
Ubuntu:22.04:LTS
 All versions, plus listed versions
0.7.24+ds-10.7.24+ds-20.7.31+ds+~0.7.36-1
 None known
node-ua-parser-js
Ubuntu:24.04:LTS
 All versions, plus listed versions
0.8.1+ds+~0.7.36-3
 None known
node-ua-parser-js
Ubuntu:25.10
 All versions, plus listed versions
0.8.1+ds+~0.7.36-3
 None known
node-ua-parser-js
Ubuntu:26.10
 All versions, plus listed versions
0.8.1+ds+~0.7.36-32.0.10+ds+~cs0.3.5-1
 None known
node-ua-parser-js
Ubuntu:26.04:LTS
 All versions, plus listed versions
0.8.1+ds+~0.7.36-3
 None known

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubmasahiro331/cve-2022-259272023-02-01
PoC in GitHubSleuth-in-town/CVE-2022-25927-test2026-03-28

History

History
RecordedChangedSources
exploitsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-25927 is a medium vulnerability (CVSS 5.3) in Ua-parser-js Project Ua-parser-js, published January 24, 2023. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.77%, the 78th percentile. Fixed in ua-parser-js 1.0.33.

References

Show 4 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open