HIGH
GHSA-pjmx-9xr3-82qr
ReDoS via long UserAgent header in useragent
Quick fix
GHSA-pjmx-9xr3-82qr — useragent: upgrade to the fixed version with the command below.
npm install useragent@2.1.13Details
Affected versions of `useragent` are vulnerable to regular expression denial of service when an arbitrarily long `User-Agent` header is parsed.
## Proof of Concept ```js var useragent = require('useragent');
var badUserAgent = 'MSIE 0.0'+Array(900000).join('0')+'XBLWP'; var request = 'GET / HTTP/1.1\r\nUser-Agent: ' + badUserAgent + '\r\n\r\n'; console.log(useragent.parse(request)); ```
## Recommendation
Update to version 2.1.13 or later.
Are you affected?
Enter the version of the package you're using.