CVE-2026-48125

Medium

Description

UAParser.js is a JavaScript library to detect browsers, operating systems, CPUs, and devices from user-agent data. From 2.0.1 until 2.0.10, a regular expression denial-of-service vulnerability exists when using the Client Hints API. By sending a crafted Sec-CH-UA-Model header to an application that calls UAParser(headers).withClientHints(), an attacker can cause excessive CPU time due to catastrophic backtracking in the device regex because Client Hints values are copied without the UA_MAX_LENGTH limit used for User-Agent values. This issue is fixed in version 2.0.10.

SeverityMedium

CVSS5.3

Exploit probability—

ProductUa-parser-js

PublishedJul 14, 2026

First seenJul 14, 2026

Weakness typeCWE-400Uncontrolled resource consumption CWE-1333CWE-1333

How to fix

Update

ua-parser-js_project ua-parser-js2.0.10 or later
ua-parser-js2.0.10 or later

Affected products

Product	Affected versions	Fixed in
ua-parser-js_project ua-parser-js	2.0.1 ≤ v < 2.0.10	2.0.10
ua-parser-jsnpm	2.0.1 ≤ v < 2.0.10	2.0.10

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.