{"action":"Upgrade ua-parser-js to 2.0.10 or later.","affected":[{"fixed":"2.0.10","introduced":"2.0.1"}],"component":"ua-parser-js","cve_ids":["CVE-2026-48125"],"ecosystem":"npm","epss":0.00523,"exploited":false,"fixed_versions":["2.0.10"],"ghsa_id":"GHSA-9h5v-pfqq-x599","id":"tcs_01M5KFFYM51PFDBNBFQVV4ZFYV","modified_at":"2026-06-15T20:41:40.397379Z","published_at":"2026-06-15T20:15:02Z","references":["https://osv.dev/vulnerability/GHSA-9h5v-pfqq-x599","https://github.com/faisalman/ua-parser-js/security/advisories/GHSA-9h5v-pfqq-x599","https://github.com/faisalman/ua-parser-js"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-9h5v-pfqq-x599","url":"https://osv.dev/vulnerability/GHSA-9h5v-pfqq-x599"}],"summary":"UAParser.js: Unbounded `Sec-CH-UA-Model` parsing can trigger ReDoS in `withClientHints()`"}