Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe analysis of the vulnerability and the associated patch commit 90354d3458495628b1d3ba68a9d76673e6d14fc5 reveals a ReDoS (Regular Expression Denial of Service) vulnerability in the ua-parser-js library. The root cause is twofold. First, the UAParser constructor did not limit the length of the Sec-CH-UA-Model header value when parsing client hints. Second, a vulnerable regular expression / ([\w ]+) miui\/v?\d/i used for device detection was susceptible to catastrophic backtracking when processing a long, crafted string.
The exploitation is triggered when an application uses the withClientHints() method on a UAParser instance that has been initialized with malicious headers. The patch addresses both issues by introducing a new normalizeHeaderValue function that truncates the header input to a safe length and by making the vulnerable regex more specific to prevent backtracking (/; ([\w ]+) miui\/v?\d/i).
The identified vulnerable functions are UAParser (the constructor) and UAParser.withClientHints. The constructor is where the untrusted input is processed without validation, and withClientHints is the method that enables the vulnerable execution path, making both critical indicators for this vulnerability.
UAParsersrc/main/ua-parser.js
UAParser.withClientHintssrc/main/ua-parser.js
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| ua-parser-js | npm | >= 2.0.1, < 2.0.10 | 2.0.10 |