CVE-2026-48125

Awaiting Analysis Awaiting Analysis - Queue

ReDoS in UAParser.js via Client Hints API

Publication date: 2026-07-14

Last updated on: 2026-07-15

Assigner: GitHub, Inc.

Description

UAParser.js is a JavaScript library to detect browsers, operating systems, CPUs, and devices from user-agent data. From 2.0.1 until 2.0.10, a regular expression denial-of-service vulnerability exists when using the Client Hints API. By sending a crafted Sec-CH-UA-Model header to an application that calls UAParser(headers).withClientHints(), an attacker can cause excessive CPU time due to catastrophic backtracking in the device regex because Client Hints values are copied without the UA_MAX_LENGTH limit used for User-Agent values. This issue is fixed in version 2.0.10.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-14

Last Modified

2026-07-15

Generated

2026-08-04

AI Q&A

2026-07-15

EPSS Evaluated

2026-08-02

NVD

CVE-2026-48125

Affected Vendors & Products

Vendor	Product	Version / Range
ua-parser	ua-parser.js	From 2.0.1 (inc) to 2.0.10 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1333	The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

UAParser.js is a library that detects browser and device info from user-agent data. Versions 2.0.1 to 2.0.10 have a denial-of-service flaw when using the Client Hints API. Attackers can exploit this by sending a specially crafted header to trigger excessive CPU usage due to a regex flaw.

Detection Guidance

To detect this vulnerability, monitor for excessive CPU usage or slow responses when processing User-Agent or Client Hints headers. Check if your application uses UAParser.js versions between 2.0.1 and 2.0.9. Inspect network traffic for unusually large or malformed Sec-CH-UA-Model headers.

Impact Analysis

This vulnerability can cause high CPU usage on servers or applications using affected UAParser.js versions. It may lead to degraded performance, service slowdowns, or crashes if exploited repeatedly. Users might experience delays or downtime in services relying on UAParser.js for device detection.

Mitigation Strategies

Upgrade UAParser.js to version 2.0.10 or later immediately. If upgrading is not possible, disable the Client Hints API integration or implement input validation to limit header size. Review and restrict access to endpoints using UAParser.js with Client Hints.

Hi! I’m here to help you understand CVE-2026-48125. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70