CVE-2026-73089High· 7.5▾ TwilightBrowserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, index.js retains every distinct `(queries, context)` result in cache and every parseQueries() AST in parseCac…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 1.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.4%
Last analysed / modified upstream
0.4% → 0.5%
Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, index.js retains every distinct (queries, context) result in cache and every parseQueries() AST in parseCache without a size cap, TTL, or eviction, allowing an attacker who can influence repeated browserslist() query values, including valid since <year>-<month>-<day> queries, to bypass the caller-controlled BROWSERSLIST_DISABLE_CACHE mitigation and cause linear memory growth followed by an out-of-memory process crash. This issue is fixed in version 4.28.7.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
browserslist <= 4.28.6Patched in:
browserslist 4.28.7Source: https://github.com/advisories/GHSA-c83g-rgw3-j3cx
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-73088High· 7.5Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools
CVE-2026-14257High· 7.5brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function (CVE-2026-14257)
CVE-2026-67320High· 7.4axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy
CVE-2026-73646High· 7.5PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree
CVE-2026-12151High· 7.5undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)
CVE-2026-80212High· 7.5An issue was discovered in the resolv gem before 0.7.2 for Ruby