What is GHSA-fhg7-m89q-25r3?

GHSA-fhg7-m89q-25r3 is a security advisory published by GitHub Security Advisories with High severity. ReDoS Vulnerability in ua-parser-js version

Which CVE IDs does GHSA-fhg7-m89q-25r3 cover?

GHSA-fhg7-m89q-25r3 covers the following CVE IDs: CVE-2022-25927. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-fhg7-m89q-25r3?

GHSA-fhg7-m89q-25r3 has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-fhg7-m89q-25r3?

GHSA-fhg7-m89q-25r3 affects 2 products, including: npm/ua-parser-js:\u003e= 0.8.0, \u003c 1.0.33; npm/ua-parser-js:\u003e= 0.7.30, \u003c 0.7.33.

GHSA-fhg7-m89q-25r3HighCVSS 7.5

ReDoS Vulnerability in ua-parser-js version

Vendor

GitHub Security Advisories

Published

January 24, 2023

Last Modified

October 17, 2025

🔗 CVE IDs covered (1)

CVE-2022-25927 →

📋 Description

Description:

A regular expression denial of service (ReDoS) vulnerability has been discovered in ua-parser-js.

Impact:

This vulnerability bypass the library's MAX_LENGTH input limit prevention. By crafting a very-very-long user-agent string with specific pattern, an attacker can turn the script to get stuck processing for a very long time which results in a denial of service (DoS) condition.

Affected Versions:

From version 0.7.30 to before versions 0.7.33 / 1.0.33.

Patches:

A patch has been released to remove the vulnerable regular expression, update to version 0.7.33 / 1.0.33 or later.

References:

Regular expression Denial of Service - ReDoS

Credits:

Thanks to @Snyk who first reported the issue.

🎯 Affected products2

npm/ua-parser-js:>= 0.8.0, < 1.0.33
npm/ua-parser-js:>= 0.7.30, < 0.7.33