CVE-2022-25927 MEDIUM

CVE-2022-25927

Vendor N/A

Product ua-parser-js

Weakness CWE-1333

Published January 25, 2023

Last update April 1, 2025

View on NVD All CVEs

CVSS base score

5.3/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality None

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P

What the vulnerability does

01Description

Versions of the package ua-parser-js from 0.7.30 and before 0.7.33, from 0.8.1 and before 1.0.33 are vulnerable to Regular Expression Denial of Service (ReDoS) via the trim() function.

Key dates

02Disclosure timeline

January 25, 2023 CVE published

April 1, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-25927 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/1333.html

Related vulnerabilities

Identifiers

CVE CVE-2022-25927

CWE CWE-1333

CVSS 5.3 / MEDIUM

Affected versions

Vendor N/A

Product ua-parser-js

Affected ≥ 0.7.30 and < 0.7.33

Vendor N/A

Product ua-parser-js

Affected ≥ 0.8.1 and < 1.0.33

CVE-2022-25927

01Description

02Disclosure timeline

03References

04Related CVE