{"cve":"CVE-2021-27292","nvd":{"published":"2021-03-17T13:15:15.200","modified":"2026-06-17T03:44:37.440","status":"Modified","description":"ua-parser-js >= 0.7.14, fixed in 0.7.24, uses a regular expression which is vulnerable to denial of service. If an attacker sends a malicious User-Agent header, ua-parser-js will get stuck processing it for an extended period of time.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5},"cwes":[],"references":["https://gist.github.com/b-c-ds/6941d80d6b4e694df4bc269493b7be76","https://github.com/faisalman/ua-parser-js/commit/809439e20e273ce0d25c1d04e111dcf6011eb566","https://github.com/pygments/pygments/commit/2e7e8c4a7b318f4032493773732754e418279a14","https://gist.github.com/b-c-ds/6941d80d6b4e694df4bc269493b7be76","https://github.com/faisalman/ua-parser-js/commit/809439e20e273ce0d25c1d04e111dcf6011eb566"],"products":["ua-parser-js_project:ua-parser-js"],"source":"nvd","synced_at":"2026-10-19T21:15:50.279857260+00:00"},"epss":{"cve":"CVE-2021-27292","score":0.03366,"percentile":0.8874,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-78cj-fxph-m83p","url":"https://osv.dev/vulnerability/GHSA-78cj-fxph-m83p","summary":"Regular Expression Denial of Service (ReDoS) in ua-parser-js","modified":"2023-11-08T04:05:24.127561Z","packages":[{"ecosystem":"npm","name":"ua-parser-js","purl":"pkg:npm/ua-parser-js","ranges":[">=0.7.14 <0.7.24"],"fixed":["0.7.24"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}