Skip to main content

Browserslist CVE-2026-73089

| EUVDEUVD-2026-56600 HIGH
Allocation of Resources Without Limits or Throttling (CWE-770)
2026-08-11 security-advisories@github.com
Denial Of Service Node.js Red Hat Suse
7.5
CVSS 3.1 · Vendor: github
Share

Severity by source

Vendor (github) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.9 MEDIUM

AC:H because exploitability requires a non-default runtime deployment where user input reaches browserslist(); build-time-only use (the norm) has zero attack surface.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
7.5 HIGH
qualitative

Primary rating from Vendor (github).

CVSS VectorVendor: github

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
Patch available
Aug 11, 2026 - 18:19 EUVD
Source Code Evidence Fetched
Aug 11, 2026 - 17:43 vuln.today
Analysis Generated
Aug 11, 2026 - 17:43 vuln.today
CVE Published
Aug 11, 2026 - 17:19 cve.org
HIGH 7.5

DescriptionCVE.org

Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, index.js retains every distinct (queries, context) result in cache and every parseQueries() AST in parseCache without a size cap, TTL, or eviction, allowing an attacker who can influence repeated browserslist() query values, including valid since <year>-<month>-<day> queries, to bypass the caller-controlled BROWSERSLIST_DISABLE_CACHE mitigation and cause linear memory growth followed by an out-of-memory process crash. This issue is fixed in version 4.28.7.

Articles & Coverage 1

News 6 New Node.js Vulnerabilities - 6 High Severity Patched Aug 12, 2026

AnalysisAI

Unbounded in-memory caches in Browserslist prior to 4.28.7 allow unauthenticated remote denial-of-service via Node.js out-of-memory crash when an attacker can influence repeated query values passed to browserslist() at runtime. Both the query-result cache and the parseQuery AST cache grew as plain JavaScript objects with no size cap, TTL, or eviction - the since <year>-<month>-<day> syntax provides a practically infinite key space ideal for flooding. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Identify runtime browserslist() API endpoint
Delivery
Craft unique since <year>-<month>-<day> query strings
Exploit
Submit high-volume requests with varied date keys
Execution
Grow Node.js heap unboundedly via unpurged cache entries
Persist
Exhaust process memory
Impact
Trigger OOM crash and service outage
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires that an attacker can supply or influence the query string arguments passed to the browserslist() function within a running Node.js process at runtime - for example, through an HTTP API parameter, a WebSocket message, or any other externally-reachable code path that forwards input into browserslist() without sanitization. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The NVD-assigned CVSS of 7.5 (AV:N/AC:L/PR:N/UI:N/A:H) reflects the maximum theoretical risk surface and overstates real-world exploitability for most deployments. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker who discovers an HTTP API endpoint that accepts browser targeting parameters and passes them to browserslist() at runtime sends thousands of requests with unique `since 1990-01-<incrementing-day>` query strings, each generating a distinct cache key that causes both the result cache and parseCache to grow. With no eviction boundary in versions before 4.28.7, Node.js heap grows linearly with each unique query until the process is terminated by the operating system or Node.js runtime with an out-of-memory error, resulting in service unavailability. …
Remediation Upgrade Browserslist to version 4.28.7 or later - this is the vendor-released patch confirmed by commit f2931a3ff2a3a31abf84ef01a7400b270aad6405 and the release tag at https://github.com/browserslist/browserslist/releases/tag/4.28.7. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, audit all applications and dependencies using Browserslist versions earlier than 4.28.7 by scanning package-lock.json and yarn.lock files across your infrastructure. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Node.js

View all
CVE-2024-41713 CRITICAL POC
9.1 Oct 21

A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
CVE-2024-55591 CRITICAL POC
9.8 Jan 14

FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
CVE-2014-7205 CRITICAL POC
10.0 Oct 08

Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
CVE-2025-59528 CRITICAL POC
10.0 Sep 22

Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
CVE-2017-14849 HIGH POC
7.5 Sep 28

Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
CVE-2017-5941 CRITICAL POC
9.8 Feb 09

An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
CVE-2014-3744 HIGH POC
7.5 Oct 23

Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
CVE-2014-9566 HIGH POC
7.5 Mar 10

Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
CVE-2013-4660 MEDIUM POC
6.8 Jun 28

The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
CVE-2015-5688 MEDIUM POC
5.0 Sep 04

Directory traversal vulnerability in lib/app/index.js in Geddy before 13.0.8 for Node.js allows remote attackers to read
CVE-2026-45321 CRITICAL POC
9.6 May 12

Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
CVE-2014-7192 CRITICAL POC
10.0 Dec 11

Eval injection vulnerability in index.js in the syntax-error package before 1.1.1 for Node.js 0.10.x, as used in IBM Rat

Same weakness CWE-770 – Allocation of Resources Without Limits or Throttling

View all
CVE-2017-8779 HIGH POC
7.5
CVE-2025-53521 CRITICAL POC
9.3
CVE-2017-5850 HIGH POC
7.5
CVE-2025-26682 HIGH
7.5
CVE-2025-41770 HIGH
8.7
CVE-2025-26466 MEDIUM
5.9
CVE-2020-37067 CRITICAL POC
9.8
CVE-2021-47875 CRITICAL POC
9.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
openSUSE Leap 16.0 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 12 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

Share

CVE-2026-73089 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy