CVE-2026-48125 Details
Description
UAParser.js is a JavaScript library to detect browsers, operating systems, CPUs, and devices from user-agent data. From 2.0.1 until 2.0.10, a regular expression denial-of-service vulnerability exists when using the Client Hints API. By sending a crafted Sec-CH-UA-Model header to an application that calls UAParser(headers).withClientHints(), an attacker can cause excessive CPU time due to catastrophic backtracking in the device regex because Client Hints values are copied without the UA_MAX_LENGTH limit used for User-Agent values. This issue is fixed in version 2.0.10.
A regular expression denial-of-service vulnerability has been identified in UAParser.js versions 2.0.1 prior to 2.0.10. The issue arises when the Client Hints API is used, specifically with the Sec-CH-UA-Model header. An attacker can exploit this vulnerability by sending a crafted header, causing excessive CPU usage due to catastrophic backtracking in the device regular expression. This exploitation is possible because Client Hints values are not subject to the same length limitation as User-Agent values, allowing for a significant increase in input size and subsequent processing time.
Users are advised to update UAParser.js to version 2.0.10 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/faisalman/ua-parser-js/security/advisories/GHSA-9h5v-pfqq-x599 | CISA-ADP | ExploitVendor Advisory |
| https://github.com/faisalman/ua-parser-js/commit/90354d3458495628b1d3ba68a9d76673e6d14fc5 | [email protected] | Patch |
| https://github.com/faisalman/ua-parser-js/releases/tag/2.0.10 | [email protected] | Release Notes |
| https://github.com/faisalman/ua-parser-js/security/advisories/GHSA-9h5v-pfqq-x599 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1333 | Inefficient Regular Expression Complexity | [email protected] |
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ua-parser-js project ua-parser-js | >= 2.0.1, < 2.0.10 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 6, 2026 | Initial Analysis | [email protected] |
| Jul 15, 2026 | CVE Modified | CISA-ADP |
| Jul 14, 2026 | New CVE Received | [email protected] |