CVE catalog
CVE-2026-48125
UAParser.js is a JavaScript library to detect browsers, operating systems, CPUs, and devices from user-agent data. From 2.0.1 until 2.0.10, a regular expression denial-of-service vulnerability exists
- Severity
- Medium · CVSS 5.3
- Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.52% · Oct 22, 2026
UAParser.js is a JavaScript library to detect browsers, operating systems, CPUs, and devices from user-agent data. From 2.0.1 until 2.0.10, a regular expression denial-of-service vulnerability exists when using the Client Hints API. By sending a crafted Sec-CH-UA-Model header to an application that calls UAParser(headers).withClientHints(), an attacker can cause excessive CPU time due to catastrophic backtracking in the device regex because Client Hints values are copied without the UA_MAX_LENGTH limit used for User-Agent values. This issue is fixed in version 2.0.10.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | node-ua-parser-js | sid | 2.0.10+ds+~cs0.3.5-1 | fixed |
| Debian | node-ua-parser-js | forky | 2.0.10+ds+~cs0.3.5-1 | fixed |
| Debian | node-ua-parser-js | trixie | 0.8.1+ds+~0.7.36-3 | vulnerable |
| Debian | node-ua-parser-js | bookworm | 0.8.1+ds+~0.7.36-3 | vulnerable |
| Cpe | node-ua-parser-js | Not reported | Not reported | vulnerable |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | node-ua-parser-js | source | sid | 2.0.10+ds+~cs0.3.5-1 | not yet assigned | Not reported | Not reported |
| Debian | node-ua-parser-js | source | forky | 2.0.10+ds+~cs0.3.5-1 | not yet assigned | Not reported | Not reported |
| Debian | node-ua-parser-js | source | trixie | (unfixed) | not yet assigned | Not reported | Not reported |
| Debian | node-ua-parser-js | source | bookworm | (unfixed) | not yet assigned | Not reported | Not reported |
Notes
[trixie] node-ua-parser-js: Minor issue [bookworm] node-ua-parser-js: minor issue
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [node-ua-parser-js]Affected
Details (2)
0.8.1+ds+~0.7.36-3· all · bookwormAffected
nvd · node-ua-parser-js · debian · bookworm; nvd · node-ua-parser-js · debian · 12
0.8.1+ds+~0.7.36-3· all · bookwormAffected
nvd · node-ua-parser-js · debian · bookworm; nvd · node-ua-parser-js · debian · 12
[Debian 13 (Trixie)]
- [node-ua-parser-js]Affected
Details (2)
0.8.1+ds+~0.7.36-3· all · trixieAffected
nvd · node-ua-parser-js · debian · 13
0.8.1+ds+~0.7.36-3· all · trixieAffected
nvd · node-ua-parser-js · debian · 13
Observed: