Description
Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, index.js retains every distinct `(queries, context)` result in cache and every parseQueries() AST in parseCache without a size cap, TTL, or eviction, allowing an attacker who can influence repeated browserslist() query values, including valid since `<year>-<month>-<day>` queries, to bypass the caller-controlled BROWSERSLIST_DISABLE_CACHE mitigation and cause linear memory growth followed by an out-of-memory process crash. This issue is fixed in version 4.28.7.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| browserslist | browserslist | < 4.28.7 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | node-browserslist | 4.28.7+~cs8.16.65-1 | — |
| Debian 13 | node-browserslist | No fix yet | — |
| Debian 12 | node-browserslist | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | node-browserslist | No fix yet | — |
| Ubuntu 24.04 LTS | node-browserslist | No fix yet | — |
| Ubuntu 22.04 LTS | node-browserslist | No fix yet | — |
| Ubuntu 20.04 LTS | node-browserslist | No fix yet | — |
| Ubuntu 18.04 LTS | node-browserslist | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | grafana12.4 | 12.4.8-0.1.1.hum1 | RHSA-2026:54518 |
| Red Hat Hardened Images 1 | grafana13.1 | 13.1.3-0.1.1.hum1 | RHSA-2026:54517 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | agama-web-ui | 24+0.a836cced5-52.1 | openSUSE-SU-2026:11680-1 |
| openSUSE Leap 16.0 | python-pytest-html | 4.1.1-bp160.5.1 | openSUSE-SU-2026:21602-1 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | argo-workflows-ui-4.0 | 4.0.11-r0 | — |
| Wolfi rolling | jupyter-base-notebook | 7.6.3-r2 | — |
| Wolfi rolling | katib-suggestion-hyperopt | 0.19.0-r40 | — |
| Wolfi rolling | langfuse-3-compat | 3.225.7-r6 | — |
| Wolfi rolling | langfuse-3-worker | 3.225.7-r4 | — |
| Wolfi rolling | ts-patch | 4.0.1-r44 | — |
| Wolfi rolling | vitess-23 | 23.0.6-r3 | — |
| Wolfi rolling | vitess-24 | 24.0.3-r1 | — |
| Wolfi rolling | vitess-24-compat | 24.0.3-r7 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | browserslist | < 4.28.7 | 4.28.7 | GHSA-c83g-rgw3-j3cx |
Advisories 5
- WID-SEC-2026-3376 Atlassian Bamboo, Bitbucket, Confluence, Fisheye/Crucible, Jira Software und Jira Service Management: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 10, 2026
- RHSA-2026:54517 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:54518 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- openSUSE-SU-2026:11680-1 agama-web-ui-24+0.a836cced5-52.1 on GA media SUSE / openSUSE Security Updates · Sep 5, 2026
- openSUSE-SU-2026:21602-1 Security update for python-pytest-html SUSE / openSUSE Security Updates · Aug 21, 2026