CVE-2026-73089
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
Browserslist is a configuration tool for sharing target browsers and Node.js versions. Prior to 4.28.7, the cache retains all results without a size cap, allowing an attacker to bypass the BROWSERSLIST_DISABLE_CACHE mitigation and cause an out-of-memory crash.
Risk Assessment
An attacker can cause memory exhaustion and application crash, leading to service disruption.
Recommendation
Update Browserslist to version 4.28.7 or later.
Original NVD description (English source)
Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, index.js retains every distinct `(queries, context)` result in cache and every parseQueries() AST in parseCache without a size cap, TTL, or eviction, allowing an attacker who can influence repeated browserslist() query values, including valid since `<year>-<month>-<day>` queries, to bypass the caller-controlled BROWSERSLIST_DISABLE_CACHE mitigation and cause linear memory growth followed by an out-of-memory process crash. This issue is fixed in version 4.28.7.