EUVD-2026-57788
GHSA-w5vr-8v7q-w6rv
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:M/U:Amber
Network vector applies when apps expose library inputs externally; no auth required at library level; only availability impacted via unconditional process termination.
Primary rating from Vendor (seal).
CVSS VectorVendor: seal
Lifecycle Timeline
2DescriptionCVE.org
baseline-browser-mapping 2.x before 2.11.0 calls process.exit() instead of throwing on invalid or conflicting input parameters, and can trigger immediate process termination, causing denial of service.
AnalysisAI
Process termination in baseline-browser-mapping 2.x before 2.11.0 can be triggered by supplying invalid or conflicting parameters to the library, causing the entire Node.js runtime to exit via process.exit() rather than throwing a catchable error. Any application that exposes externally-supplied input to this library's API - such as getCompatibleVersions() or getAllVersions() - is vulnerable to complete process-level denial of service that cannot be recovered by application-layer error handlers. No public exploit exists and exploitation is rated unlikely per the CVSS 4.0 supplemental E:U tag, but impact when triggered is absolute: the process dies and cannot be restarted without operator intervention.
Technical ContextAI
baseline-browser-mapping is an npm package (CPE: cpe:2.3:a:web-platform-dx:baseline-browser-mapping) maintained by the web-platform-dx organization, a W3C-affiliated group, that maps web feature support across browser versions using a compact timeline database derived from MDN Browser Compatibility Data. The defective code at src/index.ts:L142 invokes process.exit() - a Node.js built-in that unconditionally terminates the runtime process - upon encountering invalid or conflicting input parameters, rather than throwing a JavaScript Error that the caller could catch. The root cause class is CWE-705 (Incorrect Control Flow Scoping): a library-level function must not use process-terminating control flow, as it violates the expected error-propagation contract of a library and escapes any try-catch boundary. The fix merged in PR #137 replaces the offending process.exit() call with a proper throw, restoring standard JavaScript exception semantics.
RemediationAI
Upgrade baseline-browser-mapping to version 2.11.0 or later, which replaces the process.exit() call with a proper thrown error and restores correct library-level error propagation; update via npm using npm install baseline-browser-mapping@^2.11.0. As an interim compensating control before upgrading, validate all parameters before passing them to the library's API functions and wrap library calls in try-catch blocks - noting that try-catch will not intercept a process.exit() call and therefore provides no real protection against this specific flaw; input validation at the application boundary is the only effective interim measure. Restricting user-controlled data from reaching the library parameters entirely is the strongest short-term mitigation. See the patch diff at https://github.com/web-platform-dx/baseline-browser-mapping/pull/137/changes.
Same weakness CWE-705 – Incorrect Control Flow Scoping
View allSame technique Denial Of Service
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today