CVE-2026-73089

High

Description

Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, index.js retains every distinct `(queries, context)` result in cache and every parseQueries() AST in parseCache without a size cap, TTL, or eviction, allowing an attacker who can influence repeated browserslist() query values, including valid since `<year>-<month>-<day>` queries, to bypass the caller-controlled BROWSERSLIST_DISABLE_CACHE mitigation and cause linear memory growth followed by an out-of-memory process crash. This issue is fixed in version 4.28.7.

SeverityHigh

CVSS7.5

Exploit probability—

ProductBrowserslist

PublishedAug 11, 2026

First seenAug 11, 2026

Weakness typeCWE-770Allocation of resources without limits

How to fix

Update

browserslist4.28.7 or later

Affected products

Product	Affected versions	Fixed in
browserslistnpm	v < 4.28.7	4.28.7

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.