UAParser.js is a JavaScript library that detects browsers, operating systems, CPUs, and devices from user‑agent data. From version 2.0.1 through 2.0.10, a regular expression denial‑of‑service flaw exists when the Client Hints API is used. A crafted Sec‑CH‑UA‑Model header sent to an application that calls UAParser(headers).withClientHints() can trigger catastrophic backtracking in the device regular expression because Client Hints values are copied without the UA_MAX_LENGTH limit applied to User‑Agent strings. This leads to excessive CPU consumption and can result in a denial of service. The issue is fixed in version 2.0.10.

The vulnerability affects the FaisalMan UAParser.js library, versions 2.0.1 through 2.0.10. Any web or server application that imports this library and calls UAParser(headers).withClientHints() is exposed on the affected versions.

The CVSS score of 5.3 indicates a moderate impact. The EPSS score of <1% suggests a low probability of exploitation in the wild, and the issue is currently not listed in the CISA KEV catalog. The attack vector is remote, via an HTTP request that includes a crafted Sec‑CH‑UA‑Model header. If an application parses Client Hints without rate limiting, it is inferred that an attacker can trigger the ReDoS and degrade service.