Skip to content
Noroxi

ua-parser-js vulnerabilitiesua-parser-js: known vulnerabilities and safe versions

npm: ua-parser-js

ua-parser-js has 6 known vulnerability records: 6 in the npm advisory data (GitHub Advisory Database via OSV, the same source npm audit uses).

By branch: 2.x is safe from 2.0.10; 1.x is safe from 1.0.33; 0.8.x has no fixed release in the records; 0.7.x is safe from 0.7.33.

Vulnerabilities and safe version by branch

Safe version: on that branch, this release and every later one (up to the branch's latest release, where known) fall outside every known record's range. Candidates are only the records' own fixed versions and the branch's latest release; "No fix" means moving off the branch.

BranchSupportLatest on branchRecordsSafe version
2.x——1medium2.0.10
1.x——2high1.0.33
0.8.x——2highNo fix
0.7.x——5high0.7.33

Support dates appear only for libraries that endoflife.date tracks.

Records

Newest first. Ranges are the record's own data; several ranges mean separate fixes per branch.

  • CVE-2026-481252026-07-14

    UAParser.js: Unbounded `Sec-CH-UA-Model` parsing can trigger ReDoS in `withClientHints()`

    Affected versions: >= 2.0.1, < 2.0.10

    medium 5.3

    Fixed in: 2.0.10

  • CVE-2022-25927exploit code exists2023-01-26

    Versions of the package ua-parser-js from 0.7.30 and before 0.7.33, from 0.8.1 and before 1.0.33 are vulnerable to Regular Expression Denial

    Affected versions: >= 0.7.30, < 0.7.33 · >= 0.8.0, < 1.0.33

    high 7.5

    Fixed in: 0.7.33, 1.0.33

    EPSS 1.7%

  • CVE-2021-42292022-05-24

    ua-parser-js Crypto Mining backdoor

    Affected versions: >= 0.7.29, < 0.7.30 · >= 0.8.0, < 0.8.1 · >= 1.0.0, < 1.0.1

    high 8.8

    Fixed in: 0.7.30, 0.8.1, 1.0.1

    EPSS 1.5%

  • CVE-2021-272922021-03-17

    ua-parser-js >= 0.7.14, fixed in 0.7.24, uses a regular expression which is vulnerable to denial of service.

    Affected versions: >= 0.7.14, < 0.7.24

    high 7.5

    Fixed in: 0.7.24

    EPSS 3.3%

  • CVE-2020-77932020-12-11

    Regular Expression Denial of Service (ReDoS)

    Affected versions: < 0.7.23

    high 7.5

    Fixed in: 0.7.23

    EPSS 3.9%

  • CVE-2020-77332020-09-16

    Regular Expression Denial of Service (ReDoS)

    Affected versions: < 0.7.22

    high 7.5

    Fixed in: 0.7.22

    EPSS 4.4%

Sources and method

Ranges: GitHub Advisory Database (OSV npm export, daily) and Retire.js (Apache-2.0). Exploitation: CISA KEV, FIRST EPSS and exploit maturity from the Noroxi CVE database. Support dates: endoflife.date.

This page and the JavaScript library scan use the same matching rule: a row without bounds is not evidence, and versions are compared in one place. A record without a version range never counts as "affected" in the version check.

Data as of October 25, 2026.

Other libraries