Skip to content
Fencer Intel
high 7.5

CVE-2021-27292 json

Regular Expression Denial of Service (ReDoS) in ua-parser-js

published 5y ago modified 4mo ago also GHSA-78cj-fxph-m83p , EUVD-2021-0991

cvss
7.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
3.4%
EPSS 3.4% chance of exploitation in 30 days, percentile 88%
public exploits
0
none known

Summary

ua-parser-js >= 0.7.14, fixed in 0.7.24, uses a regular expression which is vulnerable to denial of service. If an attacker sends a malicious User-Agent header, ua-parser-js will get stuck processing it for an extended period of time.

Patch / fix

  • npm ua-parser-js 0.7.24
  • ua-parser-js_project ua-parser-js 0.7.24
  • node-ua-parser-js Debian 14, Debian 13, Debian 12 0.7.24+ds-1

debian advisories DEBIAN-CVE-2021-27292

Is CVE-2021-27292 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-27292 updated cvss 7.5

nodejs-ua-parser-js: ReDoS via malicious User-Agent header

  • Red Hat OpenShift Service Mesh 2.0 servicemesh-grafana, servicemesh-prometheus, servicemesh-grafana-prometheus Red Hat Advanced Cluster Management for Kubernetes 2 acm-grafana-rhel8
    affected: no fix available
  • Red Hat Ceph Storage 2 grafana
    affected: no fix planned “Out of support scope”
  • Red Hat OpenShift Container Platform 3.11 kibana
    affected: no fix available “Fix deferred”
  • Red Hat OpenShift Container Platform 4 openshift4/ose-grafana, openshift4/ose-logging-kibana6, openshift4/ose-metering-presto
    affected: no fix available, no fix planned “Out of support scope”
  • Red Hat Storage 3 grafana
    affected: no fix planned “Will not fix”
  • Red Hat OpenShift Logging 5.1 openshift-logging/kibana6-rhel8 v6.8.1-108
    fixed: vendor fix RHSA-2022:0226
  • Red Hat OpenShift Logging 5.2 openshift-logging/kibana6-rhel8 v6.8.1-110
    fixed: vendor fix RHSA-2022:0230
  • Red Hat OpenShift Logging 5.3 openshift-logging/kibana6-rhel8 v6.8.1-109
    fixed: vendor fix RHSA-2022:0227
show 3 more
  • Red Hat OpenShift Container Platform 4.8 openshift4/ose-console v4.8.0-202107010336.p0.git.188a490.assembly.stream
    fixed: vendor fix RHSA-2021:2438
  • Red Hat OpenShift Jaeger 1.24 distributed-tracing/jaeger-agent-rhel8 1.24.0-9, distributed-tracing/jaeger-query-rhel8 1.24.0-9, distributed-tracing/jaeger-ingester-rhel8 1.24.0-8, distributed-tracing/jaeger-collector-rhel8 1.24.0-8, distributed-tracing/jaeger-rhel8-operator 1.24.0-16, distributed-tracing/jaeger-all-in-one-rhel8 1.24.0-8, +2 more
    fixed: vendor fix RHSA-2021:3024
  • Red Hat OpenShift Logging 5.1 openshift-logging/fluentd-rhel8 v1.7.4-102, openshift-logging/eventrouter-rhel8 v0.3.0-97, openshift-logging/elasticsearch6-rhel8 v6.8.1-98, openshift-logging/elasticsearch-proxy-rhel8 v1.0.0-102, openshift-logging/elasticsearch-rhel8-operator v5.1.7-2, openshift-logging/elasticsearch-operator-bundle v5.1.7-3, +2 more Red Hat OpenShift Logging 5.2 openshift-logging/fluentd-rhel8 v1.7.4-104, openshift-logging/eventrouter-rhel8 v0.3.0-99, openshift-logging/elasticsearch6-rhel8 v6.8.1-100, openshift-logging/logging-curator5-rhel8 v5.8.1-73, openshift-logging/elasticsearch-proxy-rhel8 v1.0.0-104, openshift-logging/elasticsearch-rhel8-operator v5.2.6-2, +4 more Red Hat OpenShift Logging 5.3 openshift-logging/fluentd-rhel8 v1.7.4-103, openshift-logging/eventrouter-rhel8 v0.3.0-98, openshift-logging/elasticsearch6-rhel8 v6.8.1-99, openshift-logging/logging-curator5-rhel8 v5.8.1-72, openshift-logging/elasticsearch-proxy-rhel8 v1.0.0-103, openshift-logging/elasticsearch-rhel8-operator v5.3.3-3, +4 more Red Hat Ceph Storage 3 grafana, grafana-container Red Hat Ceph Storage 4 rhceph/rhceph-4-dashboard-rhel8 Red Hat OpenShift Container Platform 3.11 openshift3/grafana
    +1 more products
    Red Hat OpenShift Container Platform 4.8 openshift4/ose-cli v4.8.0-202106291725.p0.git.1077b05.assembly.stream, openshift4/ose-pod v4.8.0-202107161820.p0.git.051ac4f.assembly.stream, openshift4/ose-etcd v4.8.0-202106152230.p0.git.aefa6bf.assembly.stream, openshift4/ose-tests v4.8.0-202107131424.p0.git.0d958c3.assembly.stream, openshift4/ose-coredns v4.8.0-202106291913.p0.git.642b46e.assembly.stream, openshift4/ose-grafana v4.8.0-202106291913.p0.git.b987e4b.assembly.stream, +135 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

3.37% chance of exploitation in the next 30 days, higher than 88% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • gist.github.com https://gist.github.com/b-c-ds/6941d80d6b4e694df4bc269493b7be76 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:N/I:N/A:P
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
npm ua-parser-js
>=0.7.14, <0.7.24
0.7.24

Classification

Weakness
  • CWE-400 Uncontrolled Resource Consumption

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.