uap-core

uap-core

Releases25

Frequency2 months 6 days

Last Release about 3 years ago

The regex file necessary to build language ports of Browserscope's user agent parser.

Log in to subscribe

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2021-21317 ↗	Feb 16, 2021Tuesday, 16 February 2021, 18:15	5.3 MEDIUM	5 MEDIUM
uap-core in an open-source npm package which contains the core of BrowserScope's original user agent string parser. In uap-core before version 0.11.0, some regexes are vulnerable to regular expression denial of service (REDoS) due to overlapping capture groups. This allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to maliciously crafted long strings. This is fixed in version 0.11.0. Downstream packages such as uap-python, uap-ruby etc which depend upon uap-core follow different version schemes.