--- id: CVE-2026-45819 title: >- baseline-browser-mapping 2.x before 2.11.0 calls process.exit() instead of throwing on invalid or conflicting input parameters, and can trigger immediate process termination, causing denial of service. summary: >- baseline-browser-mapping 2.x before 2.11.0 calls process.exit() instead of throwing on invalid or conflicting input parameters, and can trigger immediate process termination, causing denial of service. severity: high cvss: 7.5 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H' cwe: - CWE-705 - CWE-755 - CWE-617 vendor: Red Hat product: Red Hat Ceph Storage 9 affected: - openshift_lightspeed - openshift_pipelines - ansible_automation_platform 2 - build_of_podman_desktop - ceph_storage 9 - discovery 2 - edge_manager 1 - enterprise_linux_ai_rhel_ai 3 - openshift_ai_rhoai - openshift_container_platform 4 - openshift_data_foundation 4 - openshift_dev_spaces - satellite 6 - secrets_management_console_for_red_hat_openshift - self_service_automation_portal 2 - hardened_images - openshift_ai 2.25 patched: - hardened_images - openshift_ai 2.25 published: '2026-08-13' updated: '2026-09-09' sourceUpdated: '2026-09-09T15:52:04.827' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-45819' references: - url: >- https://github.com/web-platform-dx/baseline-browser-mapping/blob/b7881aa61c8a057e24468ab5ee18c5ecedbbf691/src/index.ts#L142 label: 22e2d327-25fe-45d7-9f0c-dcd23b7108df - url: >- https://github.com/web-platform-dx/baseline-browser-mapping/pull/137/changes#diff-7ae45ad102eab3b6d7e7896acd08c427a9b25b346470d7bc6507b6481575d519 label: 22e2d327-25fe-45d7-9f0c-dcd23b7108df - url: 'https://www.npmjs.com/package/baseline-browser-mapping' label: 22e2d327-25fe-45d7-9f0c-dcd23b7108df - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45819.json - url: 'https://access.redhat.com/security/cve/CVE-2026-45819' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2515240' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-45819' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-45819' - url: 'https://access.redhat.com/errata/RHSA-2026:54518' - url: 'https://access.redhat.com/errata/RHSA-2026:54517' - url: 'https://access.redhat.com/errata/RHSA-2026:65126' - url: 'https://github.com/web-platform-dx/baseline-browser-mapping/pull/137' - url: >- https://github.com/web-platform-dx/baseline-browser-mapping/commit/de733e2d8959559f7bb255d5927f3afcb6f31589 - url: >- https://github.com/web-platform-dx/baseline-browser-mapping/releases/tag/v2.11.0 - url: 'https://github.com/advisories/GHSA-w5vr-8v7q-w6rv' - url: 'https://access.redhat.com/errata/RHSA-2026:68044' - url: 'https://access.redhat.com/errata/RHSA-2026:68253' - url: 'https://access.redhat.com/errata/RHSA-2026:68006' - url: 'https://access.redhat.com/errata/RHSA-2026:68254' - url: 'https://access.redhat.com/errata/RHSA-2026:68754' - url: 'https://access.redhat.com/errata/RHSA-2026:68765' - url: 'https://access.redhat.com/errata/RHSA-2026:68755' tags: - nvd - csaf - vex - red-hat - ghsa - npm epss: 0.00372 epssPercentile: 0.31069 aliases: - GHSA-w5vr-8v7q-w6rv ecosystem: npm cvssSource: vendor ingestedAt: '2026-09-08T21:11:12.322Z' --- ## Overview baseline-browser-mapping 2.x before 2.11.0 calls process.exit() instead of throwing on invalid or conflicting input parameters, and can trigger immediate process termination, causing denial of service. ## Remediation Refer to the linked advisories for vendor-supplied fixes and affected version ranges. ## Package advisory (CVE-2026-45819) Affected packages: - `baseline-browser-mapping >= 2.0.0, < 2.11.0` Patched in: - `baseline-browser-mapping 2.11.0` Source: https://github.com/advisories/GHSA-w5vr-8v7q-w6rv ## Vendor advisories - **RHSA-2026:54518** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-08-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:54518) - **RHSA-2026:54517** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-08-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:54517) - **RHSA-2026:65126** · Red Hat · fixed in: Red Hat OpenShift AI 2.25 · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:65126) - **Red Hat VEX** · Important · affected: OpenShift Lightspeed, OpenShift Pipelines, Red Hat Ansible Automation Platform 2, Red Hat Build of Podman Desktop, Red Hat Ceph Storage 9, Red Hat Discovery 2, … · no fix planned: Red Hat Ansible Automation Platform 2, Secrets Management Console for Red Hat OpenShift, OpenShift Lightspeed, OpenShift Pipelines, … · updated 2026-09-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45819.json) - **RHSA-2026:68044** · Red Hat · fixed in: Red Hat Edge Manager 1.1 · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:68044) - **RHSA-2026:68253** · Red Hat · fixed in: Red Hat Edge Manager 1.1 · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:68253) - **RHSA-2026:68006** · Red Hat · fixed in: Red Hat Edge Manager 1.2 · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:68006) - **RHSA-2026:68254** · Red Hat · fixed in: Red Hat Edge Manager 1.2 · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:68254) - **RHSA-2026:68754** · Red Hat · fixed in: Red Hat OpenShift Dev Spaces 3.30 · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68754) - **RHSA-2026:68765** · Red Hat · fixed in: Red Hat Satellite 6.18 · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68765) - **RHSA-2026:68755** · Red Hat · fixed in: Red Hat Satellite 6.19 · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68755)