fix(deps): update dependency ua-parser-js to v2.0.10 [security]

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	OpenSSF
ua-parser-js (source)	dependencies	patch	2.0.4 → 2.0.10

---

UAParser.js: Unbounded Sec-CH-UA-Model parsing can trigger ReDoS in withClientHints()

CVE-2026-48125 / GHSA-9h5v-pfqq-x599

More information

Details

Summary

A regular expression denial-of-service (ReDoS) vulnerability has been discovered in ua-parser-js when using the Client Hints API. By sending a crafted Sec-CH-UA-Model header to an application that calls UAParser(headers).withClientHints(), an attacker can cause the parser to spend excessive CPU time due to catastrophic backtracking in the device regex:

/ ([\w ]+) miui\/v?\d/i

Unlike when using the User-Agent value, which has a hard limit of UA_MAX_LENGTH = 500, when using Client Hints, values are copied without a length limit before being passed into regex parsing.

PoC

const { UAParser } = require('ua-parser-js');

const headers = {
  'sec-ch-ua-platform': '"Android"',
  'sec-ch-ua-mobile': '?1',
  'sec-ch-ua-model': '"' + 'A '.repeat(25000) + '"'
};

const t0 = process.hrtime.bigint();
UAParser(headers).withClientHints();
const ms = Number(process.hrtime.bigint() - t0) / 1e6;

if (ms > 100) {
  console.log('Potential ReDoS');
}

Impact

This vulnerability allows an unauthenticated attacker to trigger a denial-of-service condition in any server-side application that uses UAParser(headers).withClientHints(). A single request with a ~32,000-character model value can consume over 400ms of CPU time, with parsing time growing polynomially with input length. The impact is availability only, there is no confidentiality or integrity impact.

Affected Versions

ua-parser-js versions >=2.0.1, <=2.0.9 are affected. The withClientHints() API is not present in version 0.7.x or 1.x.

Patches

A patch has been released to fix the vulnerable regular expression and limit the Client Hints input. Users should update to version 2.0.10 or later.

References

• Regular expression Denial of Service - ReDoS (OWASP)

Credits

Thanks to @​sondt99, who first reported the issue.

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

• https://github.com/faisalman/ua-parser-js/security/advisories/GHSA-9h5v-pfqq-x599
• https://github.com/advisories/GHSA-9h5v-pfqq-x599

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

faisalman/ua-parser-js (ua-parser-js)

v2.0.10

Compare Source

• Fix ReDoS vulnerability by limiting Client Hints input length (GHSA-9h5v-pfqq-x599)
• Add new method useExtension() in UAParser to extend custom detection rules
• Add new device vendor: Blackview, Coolpad, CUBOT, T-Mobile
• Improve browser detection: Huawei Browser, UCBrowser
• Improve OS detection: iOS
• Identify WebView user-agent as inapp browser
• extensions submodule:
  • Add new crawler: atlassian-bot, Audisto Crawler, AwarioBot, AwarioRssBot, AwarioSmartBot, BrightEdge Crawler, HubSpot Crawler, Meta-ExternalAds, Meta-WebIndexer, proximic, yacybot
  • Add new fetcher: Feedly, GoogleDocs, UptimeBot, virustotal
  • Add new library: phpcrawl
• helpers submodule:
  • Fix isElectron() function return itself

v2.0.9

Compare Source

• Restore icons directory
• Add new browser: Aloha Browser, Avira Secure Browser, Lighthouse, Luakit, Norton Private Browser
• Add new OS: Vega OS
• Improve OS detection: watchOS
• extensions submodule:
  • Add new crawler: atlassian-bot, Cloudflare-AutoRAG, Google-NotebookLM, SemrushBot-SWA
  • Add new fetcher: FlipboardProxy

v2.0.8

Compare Source

• Resolve syntax error related to import renaming in ESM build
• Add new browser: HiBrowser, Opera Neon
• Add new engine: Dillo
• Improve browser detection: Brave, TikTok
• Improve device detection: OnePlus
• Improve OS detection: Firefox OS
• extensions submodule:
  • Add new CLI: PowerShell
  • Add new email: Alpine, Android, AquaMail, Balsa, Barca, Canary, Claws Mail, eM Client, Eudora, FairEmail, Geary, Gnus, Horde::IMP, Lotus-Notes, IncrediMail, K-9 Mail, Mailbird, MailMate, Mailspring, Mutt, Newton, Nine, NylasMail, Outlook-Express, Pegasus Mail, PocoMail, Postbox, ProtonMail Bridge, Quala, R2Mail2, Rainloop, Roundcube Webmail, SamsungEmail, Spicebird, SquirrelMail, Sylpheed, The Bat!, Trojita, Turnpike, tutanota-desktop, Wanderlust, Windows-Live-Mail
  • Add new library: http.rb, Jetty, ocaml-cohttp
• helpers submodule:
  • Add new method: getOutlookEdition() to map Outlook versions to their marketing editions

v2.0.7

Compare Source

• Add support for chaining withClientHints() & withFeatureCheck()
• Add new browser: Atlas, Steam
• Add new device vendor: Anbernic, Logitech, Valve
• Improve device detection: Xiaomi
• Improve OS detection: iOS
• Split helpers submodule into several new submodules:
  • bot-detection:
    • isAIAssistant()
    • isAICrawler()
    • isBot()
  • browser-detection
    • isChromeFamily()
    • isElectron()
    • isFromEU()
    • isStandalonePWA()
  • device-detection
    • getDeviceVendor()
    • isAppleSilicon()
• Update extensions submodule:
  • Add new fetcher: Nova Act
  • Add new library: Bun, Dart, Deno, hackney, Node.js, rest-client, undici

v2.0.6

Compare Source

• Add new CLI feature: processing batch user-agent data from file and output as JSON
• Fix setUA(): trim leading space from user-agent string input
• Replace undici dependency with node's internal Headers
• Add new browser: Bing, Qwant
• Add new device vendor: Hisense, Wiko
• Improve browser detection: Mozilla, Pale Moon
• Improve CPU detection: 68k
• Improve device detection: Apple, BlackBerry, Huawei, Nokia, Xiaomi
• Improve OS detection: iOS 26
• extensions submodule:
  • Add new fetcher: Discordbot, KeybaseBot, Slackbot, Slackbot-LinkExpanding, Slack-ImgProxy, Twitterbot
  • Add new crawler: Qwantbot-news, SurdotlyBot, SwiftBot

v2.0.5

Compare Source

• Add new browser: Zalo
• Add new CPU arch: alpha
• Add new device vendor: Philips
• Improve device detection: Pico
• Fix parsing error on pages with modified Array prototypes
• Improve type declarations:
  • Replace node-fetch dependency with undici
  • Replace hardcoded string values with enum from enum submodule
• enums submodule:
  • Add Extension enum for extensions submodule
  • Type declaration file now automatically generated using build script
  • Naming adjustments:
    • Browser => BrowserName
    • CPU => CPUArch
    • Device => DeviceType
    • Vendor => DeviceVendor
    • Engine => EngineName
    • OS => OSName
• extensions submodule:
  • Add new crawlers:
    APIs-Google, Algolia Crawler, Algolia Crawler Renderscript, Baidu-ADS, BLEXBot, botify, Bravebot, Claude-Web, cohere-training-data-crawler, contxbot, Cotoyogi, Coveobot, CriteoBot, DeepSeekBot, DuckDuckGo-Favicons-Bot, Elastic, FirecrawlAgent, Freespoke, Google-CloudVertexBot, HuggingFace-Bot, Kagibot, Kangaroo Bot, marginalia, msnbot, OnCrawl, Replicate-Bot, RunPod-Bot, SBIntuitionsBot, SeekportBot, Siteimprove, Sogou Pic Spider, TikTokSpider, TwinAgent, v0bot, webzio, Webzio-Extended, xAI-Bot, YandexAccessibilityBot, YandexAdditionalBot, YandexAdNet, YandexBot MirrorDetector, YandexBlogs, YandexComBot, YandexFavicons, YandexImageResizer, YandexImages, YandexMarket, YandexMetrika, YandexMedia, YandexMobileBot, YandexMobileScreenShotBot, YandexNews, YandexOntoDB, YandexOntoDBAPI, YandexPartner, YandexRCA, YandexRenderResourcesBot, YandexScreenshotBot, YandexSpravBot, YandexTracker, YandexVertis, YandexVerticals, YandexVideo, YandexVideoParser, YandexWebmaster, YepBot, ZumBot
  • Add new fetchers:
    Asana, bitlybot, Blueno, BufferLinkPreviewBot, Chrome-Lighthouse, Gemini-Deep-Research, HubSpot Page Fetcher, kakaotalk-scrap, vercel-favicon-bot, vercel-screenshot-bot, vercelflags, verceltracing, YaDirectFetcher, YandexCalendar, YandexDirect, YandexDirectDyn, YandexForDomain, YandexPagechecker, YandexSearchShop, YandexSitelinks, YandexUserproxy
• helpers submodule:
  • Add some crawler to isAIBot():
    Bravebot, cohere-training-data-crawler, FirecrawlAgent, HuggingFace-Bot, Kangaroo Bot, PanguBot, Replicate-Bot, RunPod-Bot, TikTokSpider, Together-Bot, v0bot, xAI-Bot

---

Configuration

📅 Schedule: (in timezone Europe/Berlin)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.