Detections
Analytics

SCA: security update for ua-parser-js (GHSA-9h5v-pfqq-x599)

medium Tenable Cloud Security Plugin ID 443229

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - UAParser.js is a JavaScript library to detect browsers, operating systems, CPUs, and devices from user-
 agent data. From 2.0.1 until 2.0.10, a regular expression denial-of-service vulnerability exists when
 using the Client Hints API. By sending a crafted Sec-CH-UA-Model header to an application that calls
 UAParser(headers).withClientHints(), an attacker can cause excessive CPU time due to catastrophic
 backtracking in the device regex because Client Hints values are copied without the UA_MAX_LENGTH limit
 used for User-Agent values. This issue is fixed in version 2.0.10. (CVE-2026-48125)

Solution

Update the ua-parser-js library and its related packages to version 2.0.10 or later.

See Also

https://github.com/advisories/GHSA-9h5v-pfqq-x599

Plugin Details

Severity: Medium

ID: 443229

Version: Revision 1.4

Type: Local

Family: SCA Checks

Published: 6/16/2026

Updated: 7/15/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 1.2

Percentile: 0.01

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS Score Source: CVE-2026-48125

CVSS v3

Risk Factor: Medium

Base Score: 5.3

Temporal Score: 4.6

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 6/15/2026

Vulnerability Publication Date: 6/15/2026

Reference Information

CVE: CVE-2026-48125