ua-parser-js

Detect Browser, Engine, OS, CPU, and Device type/model from User-Agent & Client Hints data. Supports browser & node.js environment

Latest 2.0.10

NPM

91%

Total Score

Maintainer Stability

Dependencies

100

Maturity

100

Supply Chain

Attestations

100

Are you affected? Scan for Free

Health Score Breakdown

Project backing

The repository is owned by an individual rather than an organization, so the concentrated contributor activity has less institutional backing to offset it.

Repo bus factor

One contributor made 10 of the 12 recent commits, so maintenance is concentrated despite two additional active contributors; this is a modest continuity risk for a user-owned project.

Workflow audit

All 7 workflows were analyzed with no untrusted checkouts, script injection, or unpinned actions; however, the audit reported two low-confidence cache-poisoning findings in the npm publish workflow, a limited release-hygiene concern.

Vulnerabilities

Title	Versions	Severity
CVE-2026-48125 ua-parser-js is vulnerable to Uncontrolled Resource Consumption in versions 2.0.1 - 2.0.10.	2.0.1 - 2.0.10	Medium
CVE-2022-25927 ua-parser-js is vulnerable to Uncontrolled Resource Consumption in versions 0.8.0 - 1.0.33 and 0.7.30 - 0.7.33.	0.7.30 - 0.7.330.8.0 - 1.0.33	High
CVE-2020-7793 ua-parser-js is vulnerable to Uncontrolled Resource Consumption in versions 0.0.0 - 0.7.23.	0.0.0 - 0.7.23	High
CVE-2021-4229 ua-parser-js is vulnerable to Embedded Malicious Code in versions 0.7.29 - 0.7.29, 0.8.0 - 0.8.0 and 1.0.0 - 1.0.0.	0.7.29 - 0.7.290.8.0 - 0.8.01.0.0 - 1.0.0	High
CVE-2020-7733 ua-parser-js is vulnerable to Uncontrolled Resource Consumption in versions 0.0.0 - 0.7.22.	0.0.0 - 0.7.22	High