baseline-browser-mapping EUVD-2026-57788

Exploitation requires that attacker-controlled data reaches baseline-browser-mapping API functions - such as getCompatibleVersions() or getAllVersions() - as input parameters, and that those parameters are invalid or conflicting in a way that triggers the process.exit() branch at src/index.ts:L142. The application must pass externally-supplied values (for example, from HTTP query parameters, request bodies, or CLI arguments) to the library without sufficient prior validation. Exploitation is bounded by: the relatively niche deployment of this library (primarily in developer tooling and compatibility-checking endpoints rather than general-purpose user-facing services); the architectural requirement that the calling application exposes library inputs to external actors; and the CVSS 4.0 E:U supplemental tag indicating exploitation has not been reported. Authentication requirements are not a library-level constraint - the PR:N vector reflects that the library itself imposes no authentication; access control is determined entirely by the surrounding application.

The CVSS 4.0 base metrics (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) reflect a scenario in which an unauthenticated attacker can reach the library's API over a network and supply crafted parameters, yielding high availability impact with no confidentiality or integrity consequences. The scored value of 6.6 incorporates the supplemental E:U (exploitation unreported) and U:Amber urgency tags, which appropriately temper the theoretical base risk. Real-world exploitability is highly architecture-dependent: applications that insulate library calls from user-controlled input are not meaningfully exposed, whereas applications that pass HTTP parameters directly to library functions are fully vulnerable. No KEV listing and no public POC exist at time of analysis. EPSS data was not provided in the input, so exploitation probability cannot be quantified numerically. This is a genuine but context-bounded risk: impact when triggered is severe (process kill, unrecoverable without restart), but the conditions required for exploitation limit widespread automated targeting.

An attacker submits a crafted HTTP request with invalid or conflicting browser-version query parameters to a web application that passes user input directly to baseline-browser-mapping API functions. The library's internal error handler calls process.exit() instead of throwing, immediately terminating the Node.js server process and taking the application offline. No public POC exists, but the triggering mechanism is straightforward once the parameter space is understood.