Vulnerability · Published Aug 11, 2026 · Assigned by GitHub_M
CVE-2026-73089Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM
High 7.5
In plain English
A high-severity resource allocation without limits in browserslist from browserslist. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, index.js retains every distinct `(queries, context)` result in cache and every parseQueries() AST in parseCache without a size cap, TTL, or eviction, allowing an attacker who can influence repeated browserslist() query values, including valid since `<year>-<month>-<day>` queries, to bypass the caller-controlled BROWSERSLIST_DISABLE_CACHE mitigation and cause linear memory growth followed by an out-of-memory process crash. This issue is fixed in version 4.28.7.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | node-browserslist | no fix listed | DEBIAN-CVE-2026-73089 |
| Debian:13 | node-browserslist | no fix listed | DEBIAN-CVE-2026-73089 |
| Debian:14 | node-browserslist | 4.28.7+~cs8.16.65-1 | DEBIAN-CVE-2026-73089 |
| Ubuntu:22.04:LTS | node-browserslist | no fix listed | UBUNTU-CVE-2026-73089 |
| Ubuntu:24.04:LTS | node-browserslist | no fix listed | UBUNTU-CVE-2026-73089 |
| Ubuntu:26.04:LTS | node-browserslist | no fix listed | UBUNTU-CVE-2026-73089 |
| npm | browserslist | 4.28.7 | GHSA-c83g-rgw3-j3cx |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| browserslist | browserslist | < 4.28.7 |
Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H