CVE-2026-48125
1 advisory.
npm/ua-parser-js CVE-2026-48125: medium 5.3
UAParser.js: Unbounded `Sec-CH-UA-Model` parsing can trigger ReDoS in `withClientHints()`
Action: Upgrade ua-parser-js to 2.0.10 or later.
npm i ua-parser-js@2.0.10Affected
| introduced | fixed | last affected |
|---|---|---|
| 2.0.1 | 2.0.10 | - |
Fixed versions
| 2.0.10 |
Sources
- osv: GHSA-9h5v-pfqq-x599
- https://github.com/faisalman/ua-parser-js/security/advisories/GHSA-9h5v-pfqq-x599
- https://github.com/faisalman/ua-parser-js
CVE-2026-48125 · published · modified · JSON