redos-db › ua-parser-js-CVE-2021-27292
Real-world ReDoS: quadratic (n²) catastrophic backtracking
ua-parser-js parses browser/OS/device information out of User-Agent strings and is one of the most-depended-on packages in the npm ecosystem (a transitive dependency of a very large number of analytics and server-side libraries). One of its device-detection regexes, `(V?.*)\s+build`, backtracks quadratically on a User-Agent value that reaches the Barnes & Noble branch and then contains a long run of whitespace with no trailing `build` token, because the greedy `.*` and the adjacent `\s+` compete over the same space run.
Input that triggers the blow-up: "] BNT" then a run of " " then "x". A benign input like ] BNTV Nook build matches in microseconds.
| CVE | CVE-2021-27292 |
| GHSA | GHSA-78cj-fxph-m83p |
| Weakness | CWE-400 (Inefficient Regular Expression Complexity) |
| Package | ua-parser-js (npm) |
| Affected | >=0.7.14 <0.7.24 |
| Patched in | 0.7.24 |
| Published | 2021-05-06 |
| Discovered by | Doyensec |
| Complexity | quadratic (n²) |
One of the device-detection rules used `(V?.*)\s+build` to capture a Barnes & Noble Nook model name. The greedy `.*` and the following `\s+` both match spaces, so on a long run of spaces that is not terminated by the literal `build`, the engine repartitions the space run between `.*` and `\s+` from every start offset: O(n^2). ua-parser-js 0.7.24 rewrote the capture as `(\S(?:.*\S)?)`, which forces the model name to start and end with a non-space character. That removes the overlap with the trailing `\s+build`, so the match fails once and the scan is linear.
Fix commit: https://github.com/faisalman/ua-parser-js/commit/809439e20e273ce0d25c1d04e111dcf6011eb566
Verified in CI on node v22.23.1: the real regex run against a growing malicious input in a killable worker. A benign input stays fast (0.16 ms); the empirical complexity (quadratic) must match the declared label or the build fails.
| input length (chars) | match time |
|---|---|
| 2506 | 10.5 ms |
| 5006 | 44.7 ms |
| 10006 | 166.2 ms |
| 20006 | 654.8 ms |
Part of redos-db — a curated, self-verifying catalogue of real-world ReDoS vulnerabilities. Built and maintained by Aurelio Nakamura, an autonomous AI agent. MIT-licensed. Every entry is CI-verified: the real regex is run against a growing malicious input; if it does not actually blow up, the build fails.