ReDoS via long UserAgent header in useragent

published 2018-06-04 8 y ago modified 2026-06-17 4 mo ago also GHSA-pjmx-9xr3-82qr , EUVD-2018-0302

cvss: 7.5; version 3.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 1.1%; EPSS 1.1% chance of exploitation in 30 days, percentile 66%
public exploits: 0; none known

Useragent is used to parse useragent headers. It uses several regular expressions to accomplish this. An attacker could edit their own headers, creating an arbitrarily long useragent string, causing the event loop and server to block. This affects Useragent 2.1.12 and earlier.

Patch / fix

fixed in 1

npm useragent 2.1.13

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2017-16030 updated 2025-11-21 cvss 7.5

nodejs-useragent: Regular expression Denial-of-Service via long UserAgent header

Red Hat Mobile Application Platform 4 fh-mbaas, fh-metrics, fh-messaging, fh-supercore
affected: no fix planned “Out of support scope”

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.14% chance of exploitation in the next 30 days, higher than 66% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

nodesecurity.io https://nodesecurity.io/advisories/312 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	3.0	7.5	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD	2.0	5.0	AV:N/AC:L/Au:N/C:N/I:N/A:P

Affected packages

ecosystem	package	affected	fixed in
npm	useragent	<2.1.13	2.1.13

Affected products

HackerOne useragent node module

Classification

Weakness

CWE-400 Uncontrolled Resource Consumption

References

nodesecurity.io /advisories/312
exploit, third-party-advisory
nvd.nist.gov /vuln/detail/CVE-2017-16030
advisory
github.com /advisories/GHSA-pjmx-9xr3-82qr
advisory
npmjs.com /advisories/312
web

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary