Description
Useragent is used to parse useragent headers. It uses several regular expressions to accomplish this. An attacker could edit their own headers, creating an arbitrarily long useragent string, causing the event loop and server to block. This affects Useragent 2.1.12 and earlier.
Remediation
References
https://nodesecurity.io/advisories/312
Related Vulnerabilities
CVE-2016-10538 Vulnerability in npm package cli
CVE-2022-39243 Vulnerability in maven package com.zaxxer:nuprocess
CVE-2021-21413 Vulnerability in npm package isolated-vm
CVE-2020-28277 Vulnerability in maven package org.webjars.npm:dset
CVE-2016-4055 Vulnerability in maven package org.fujion.webjars:moment