CVE-2026-73089

Name of the Vulnerable Software and Affected Versions Browserslist versions prior to 4.28.7

Description Browserslist is a configuration tool used to share target browsers and Node.js versions among front-end tools. The index.js file retains every distinct (queries, context) result in cache and every parseQueries() AST (Abstract Syntax Tree) in parseCache without a size cap, Time-To-Live (TTL), or eviction mechanism. An attacker capable of influencing repeated browserslist() query values, such as those using the since <year>-<month>-<day> format, can bypass the BROWSERSLIST DISABLE CACHE mitigation. This leads to linear memory growth and can result in an out-of-memory process crash.

Recommendations Update Browserslist to version 4.28.7.