Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
UAParser.js is a JavaScript library to detect browsers, operating systems, CPUs, and devices from user-agent data. From 2.0.1 until 2.0.10, a regular expression denial-of-service vulnerability exists when using the Client Hints API. By sending a crafted Sec-CH-UA-Model header to an application that calls UAParser(headers).withClientHints(), an attacker can cause excessive CPU time due to catastrophic backtracking in the device regex because Client Hints values are copied without the UA_MAX_LENGTH limit used for User-Agent values. This issue is fixed in version 2.0.10.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
🟠 ua-parser-js, ReDoS, #CVE-2026-48125 (Medium) -DC-Jun2026-452 https://dailycve.com/ua-parser-js-redos-cve-2026-48125-medium-dc-jun2026-452/
Post summary
The post announces a medium‑scored ReDoS vulnerability in ua-parser-js (CVE‑2026‑48125) and provides a link to DailyCVE for further details.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | ua-parser-js_project | ua-parser-js | - | node.js | - |