CVE-2026-48125: UAParser.js ReDoS Denial of Service Flaw

CVE-2026-48125 Overview

CVE-2026-48125 is a regular expression denial-of-service (ReDoS) vulnerability in UAParser.js, a widely used JavaScript library for parsing user-agent data. The flaw affects versions 2.0.1 through 2.0.9 when applications invoke UAParser(headers).withClientHints(). An attacker can send a crafted Sec-CH-UA-Model HTTP header that triggers catastrophic backtracking in the device-matching regular expression. The issue exists because Client Hints values are copied without enforcing the UA_MAX_LENGTH limit applied to standard User-Agent strings. The vulnerability is tracked under [CWE-400: Uncontrolled Resource Consumption].

Critical Impact
Remote unauthenticated attackers can exhaust server CPU by sending a single malformed Client Hints header, degrading availability of any web service that parses Client Hints with UAParser.js.

Affected Products

UAParser.js versions 2.0.1 through 2.0.9
Node.js and browser applications calling UAParser(headers).withClientHints()
Web services accepting the Sec-CH-UA-Model Client Hints header

Discovery Timeline

2026-07-14 - CVE-2026-48125 published to NVD
2026-07-15 - Last updated in NVD database
Patch released - UAParser.js version 2.0.10 published on GitHub with fix commit 90354d3

Technical Details for CVE-2026-48125

Vulnerability Analysis

UAParser.js exposes a withClientHints() method that parses HTTP Client Hints headers, including Sec-CH-UA-Model, to identify the requesting device. Internally, the library applies device regular expressions designed for User-Agent strings. Those expressions contain nested quantifiers susceptible to catastrophic backtracking when fed adversarial input.

For standard User-Agent parsing, the library enforces a length ceiling defined by the UA_MAX_LENGTH constant. This limit was not applied to values extracted from Client Hints headers. As a result, an attacker can supply an oversized or specially structured Sec-CH-UA-Model value that forces the regex engine into exponential-time evaluation. A single request can consume significant CPU, and repeated requests can render the Node.js event loop unresponsive.

Root Cause

The root cause is missing input normalization inside the itemListToArray helper that processes Client Hints header tokens. Values were passed directly into the device regex without truncation, bypassing the safeguard that protects the User-Agent code path.

Attack Vector

Exploitation requires only network access to an HTTP endpoint that calls withClientHints() on request headers. No authentication or user interaction is required. The attacker sends a POST or GET request containing a crafted Sec-CH-UA-Model value engineered to trigger backtracking in the device regex.

javascript

// Patched code from src/main/ua-parser.js (commit 90354d3)
itemListToArray = function (header) {
    if (!header) return undefined;
    var arr = [];
    // Before: var tokens = strip(/\\?\"/g, header).split(',');
    // After:  input is normalized and length-limited
    var tokens = normalizeHeaderValue(header).split(',');
    for (var i = 0; i < tokens.length; i++) {
        if (tokens[i].indexOf(';') > -1) {
            var token = trim(tokens[i]).split(';v=');

Source: GitHub commit 90354d3

The fix introduces normalizeHeaderValue(), which enforces a maximum length on Client Hints tokens before they reach the vulnerable regex.

Detection Methods for CVE-2026-48125

Indicators of Compromise

Requests containing unusually long Sec-CH-UA-Model, Sec-CH-UA-Platform, or Sec-CH-UA header values, particularly with repeating character patterns
Sustained Node.js event loop lag or single-CPU saturation correlated with inbound HTTP traffic
Increased request latency or 503 responses from services that call UAParser().withClientHints()

Detection Strategies

Inspect HTTP access logs for Client Hints headers exceeding a few hundred bytes, which is well beyond legitimate device model strings
Instrument application code around withClientHints() calls to measure parse duration and alert on outliers exceeding 100ms
Correlate CPU spikes on Node.js workers with concurrent inbound requests carrying Client Hints headers from the same source IP

Monitoring Recommendations

Enable web application firewall (WAF) rules to log and rate-limit anomalous Client Hints header lengths
Track dependency inventories for ua-parser-js versions between 2.0.1 and 2.0.9 using software composition analysis (SCA) tooling
Monitor process-level CPU and event-loop metrics for Node.js services parsing HTTP headers

How to Mitigate CVE-2026-48125

Immediate Actions Required

Upgrade ua-parser-js to version 2.0.10 or later across all Node.js and frontend projects
Audit application code for calls to UAParser(headers).withClientHints() and confirm the patched version is loaded at runtime
Deploy WAF or reverse-proxy rules that reject requests with oversized Sec-CH-UA-* headers as a compensating control

Patch Information

The fix is available in UAParser.js 2.0.10, released on GitHub. See the GitHub Release for version 2.0.10 and the GitHub Security Advisory GHSA-9h5v-pfqq-x599. The patch adds a normalizeHeaderValue() helper that truncates Client Hints tokens before regex evaluation.

Workarounds

Strip or truncate Sec-CH-UA-Model and related Client Hints headers at an upstream proxy before they reach the application
Disable calls to withClientHints() and rely only on User-Agent parsing until the upgrade is deployed
Enforce request timeouts and per-request CPU budgets to limit the impact of any single malformed request

bash

# Upgrade to the patched version
npm install ua-parser-js@2.0.10

# Verify installed version
npm ls ua-parser-js

# Example nginx rule to cap Client Hints header size
# large_client_header_buffers 4 1k;