CVE Feed

    Dashboard / CVE / CVE-2022-25927

    CVE-2022-25927

    Versions of the package ua-parser-js from 0.7.30 and before 0.7.33, from 0.8.1 and before 1.0.33 are vulnerable to Regular Expression Denial of Service (ReDoS) via the trim() function.

    Published:Jan 22, 2023
    Last Modified:Apr 1, 2025
    EPS:Jan 25, 2023
    EPSS Score:0.01372
    CVSS Score:5.3

    Affected Products

    Vendor
    Redhat
    Product
    Rhmt
    Vendor
    Ua-parser-js Project
    Product
    Ua-parser-js

    Exploits

    https://security.snyk.io/vuln/SNYK-JS-UAPARSERJS-3244450https://security.snyk.io/vuln/SNYK-JS-UAPARSERJS-3244450https://github.com/masahiro331/cve-2022-25927https://github.com/Sleuth-in-town/CVE-2022-25927-test

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-492 Regular Expression Exponential Blowup

    Related CVEs

    CVE-2025-22871 (CVSS 9.1) — The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This …
    CVE-2025-30204 (CVSS 7.5) — golang-jwt is a Go implementation of JSON Web Tokens. Starting in version 3.2.0 and prior to versions 5.2.2 an…
    CVE-2025-22868 (CVSS 7.5) — An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing.…
    CVE-2024-45338 (CVSS 5.3) — An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its…
    CVE-2024-21538 (CVSS 7.7) — Versions of the package cross-spawn before 6.0.6, from 7.0.0 and before 7.0.5 are vulnerable to Regular Expres…
    CVE-2024-21536 (CVSS 7.7) — Versions of the package http-proxy-middleware before 2.0.7, from 3.0.0 and before 3.0.3 are vulnerable to Deni…
    CVE-2024-45590 (CVSS 7.5) — body-parser is Node.js body parsing middleware. body-parser <1.20.3 is vulnerable to denial of service when ur…
    CVE-2024-43800 (CVSS 5) — serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to red…
    CVE-2024-43799 (CVSS 5) — Send is a library for streaming files from the file system as a http response. Send passes untrusted user inpu…
    CVE-2024-43796 (CVSS 5) — Express.js minimalist web framework for node. In express < 4.20.0, passing untrusted user input - even after s…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High