CVE-2017-16030

Useragent is used to parse useragent headers. It uses several regular expressions to accomplish this. An attacker could edit their own headers, creating an arbitrarily long useragent string, causing the event loop and server to block. This affects Useragent 2.1.12 and earlier.

Score

CVSS 3.0 7.5 High

Status

Modified - support@hackerone.com

Published

2018-06-04

Last modified

2024-09-17

Weaknesses

CWE-400

Affected products

• Useragent Node Module (Hackerone)
• Useragent (Useragent Project)

References

• https://nodesecurity.io/advisories/312