CVE-2026-48125

UAParser.js is a JavaScript library to detect browsers, operating systems, CPUs, and devices from user-agent data. From 2.0.1 until 2.0.10, a regular expression denial-of-service vulnerability exists when using the Client Hints API. By sending a crafted Sec-CH-UA-Model header to an application that calls UAParser(headers).withClientHints(), an attacker can cause excessive CPU time due to catastrophic backtracking in the device regex because Client Hints values are copied without the UA_MAX_LENGTH limit used for User-Agent values. This issue is fixed in version 2.0.10.

• CWE-400
• CWE-1333

• https://github.com/faisalman/ua-parser-js/commit/90354d3458495628b1d3ba68a9d76673e6d14fc5Patch
• https://github.com/faisalman/ua-parser-js/releases/tag/2.0.10Release Notes
• https://github.com/faisalman/ua-parser-js/security/advisories/GHSA-9h5v-pfqq-x599Exploit, Vendor Advisory
• https://github.com/faisalman/ua-parser-js/security/advisories/GHSA-9h5v-pfqq-x599Exploit, Vendor Advisory

Published

Jul 14, 2026

Last Modified

Aug 6, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-48119Nezha Monitoring is a self-hostable, lightweight, servers an…7.1
• CVE-2026-4812The Advanced Custom Fields (ACF) plugin for WordPress is vul…5.3
• CVE-2026-48120Kakoune is a code editor. Prior to version 2026.05.21, the b…8.6
• CVE-2026-48121@langchain/langgraph-checkpoint-mongodb provides a LangGraph…6.7
• CVE-2026-48122Ruby LSP is an implementation of the language server protoco…5.4
• CVE-2026-48124Cursor is a code editor built for programming with AI. In ve…8.5
• CVE-2026-48126Algernon is a small self-contained pure-Go web server. Prior…8.2
• CVE-2026-48127Frappe is a full-stack web application framework. Prior to 1…5.3
• CVE-2026-48128Budibase is an open-source low-code platform. Prior to 3.39.…5.1
• CVE-2026-48129Kestra is an open-source, event-driven orchestration platfor…6.5
• CVE-2026-48131The VPN service may mishandle an unexpected IKE fragment val…8.1
• CVE-2026-48132The Security Gateway does not correctly validate a length va…8.1