Search/CVE-2022-25927
● CVE — Medium

CVE-2022-25927

Versions of the package ua-parser-js from 0.7.30 and before 0.7.33, from 0.8.1 and before 1.0.33 are vulnerable to Regular Expression Denial of Service (ReDoS) via the trim() function.

View graph Watch Export
CVSS v3.1
5.3 MEDIUM
EPSS
1.73%
probability of exploitation in 30 days
CISA KEV
Not listed
no confirmed exploitation reported
News coverage
0
sources referencing this CVE
CVSS v3.1 Detail
Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
ConfidentialityNONE
IntegrityNONE
AvailabilityLOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Connections
2 relationships
Timeline
disclosure → media coverage
Jan 26, 2023
Disclosure — published as a CVE record. · last revised by NVD Apr 1, 2025
Public PoC (2)
github.com/masahiro331/cve-2022-25927github.com/Sleuth-in-town/CVE-2022-25927-test
Unverified third-party code — review before executing.