CVE-2017-16086
ReDoS via long UserAgent header in ua-parser
EPSS 9.2%
描述
Affected versions of `ua-parser` are vulnerable to regular expression denial of service when given a specially crafted `User-Agent` header. ## Recommendation No patch is currently available for this vulnerability. The best mitigation is currently to avoid using this package, using a different, functionally equivalent package such as [useragent](https://www.npmjs.com/package/useragent).
如何修補 CVE-2017-16086
目前尚未發布修補版本。可考慮移除受影響套件,或參考下方連結中的上游建議。
- npm/ua-parser—未列出修補版本
CVE-2017-16086 正在被利用嗎?
中等 — EPSS 為 9.2%,可持續追蹤但非最高優先。
受影響套件(1)
- from 0, <= 0.3.5