CVE-2021-27292: Ua-Parser-Js Project Ua-Parser-Js

High severity, CVSS 7.5. EPSS: 3.4% chance of exploitation in the next 30 days.

ua-parser-js >= 0.7.14, fixed in 0.7.24, uses a regular expression which is vulnerable to denial of service. If an attacker sends a malicious User-Agent header, ua-parser-js will get stuck processing it for an extended period of time.

Affected products

• Ua-Parser-Js Project Ua-Parser-Js: from 0.7.14, before 0.7.24 (fixed in 0.7.24)

Published 2021-03-17. Last modified 2026-06-17.