Skip to content
OpenAdvisories

Package · Debian

node-browserslist

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • High 7.5
    CVE-2026-73089

    Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM

    Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, index.js retains every distinct `(queries, context)` result in cache and every parseQueries() AST in parseCache without a size cap,…

    browserslist browserslist node-browserslist browserslist Debian Ubuntu npm
  • High 7.5
    CVE-2026-73088

    Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)

    Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, normalizeStats() in node.js, reached unconditionally through getStat() and loadStat() on every browserslist() call, processes untru…

    browserslist browserslist browserslist node-browserslist Debian Ubuntu npm
  • Medium 5.3
    CVE-2021-23364

    Regular Expression Denial of Service (ReDoS)

    The package browserslist from 4.0.0 and before 4.16.5 are vulnerable to Regular Expression Denial of Service (ReDoS) during parsing of queries.

    browserslist node-browserslist node-browserslist Debian Ubuntu npm