Listen to this Post
This vulnerability, identified as CVE-2026-73089, resides in the `index.js` file of the `browserslist` npm package, specifically within the `cache` object for `browserslist()` results (around line ~402) and the `parseCache` object for `parseQueries()` AST results.
The root cause is that every distinct `(queries, context)` pair passed to `browserslist()` is cached indefinitely in a plain JavaScript object. These caches have no size cap, Time-To-Live (TTL), or eviction policy. The `browserslist.clearCaches()` function does not reset these in-memory caches; it only clears Node.js’s filesystem caches. The only mechanism to disable caching is the `BROWSERSLIST_DISABLE_CACHE` environment variable, which is controlled by the calling application and not by an attacker.
An attacker can exploit this by sending a stream of cheap, distinct queries. The `since
In a measured impact test, 20,000 distinct `since
This is a volumetric attack, unlike the single-request DoS findings from the same research pass that produced other CVEs like GHSA-rrmg-cfrq-23vv and GHSA-g6p8-hj8g-x889. An attacker who can influence the query value across many requests can cause a long-running process (like a server, daemon, or warm CI worker) to accumulate cache entries until it runs out of memory and crashes.
The recommended fix, which has been implemented and verified, is to replace the plain-object caches with `Map` objects bounded to a fixed maximum entry count. The oldest entry is evicted once the cap is reached, as `Map` preserves insertion order.
var CACHE_MAX_ENTRIES = 500
function boundedCacheSet(map, key, value) {
if (map.size >= CACHE_MAX_ENTRIES) {
map.delete(map.keys().next().value)
}
map.set(key, value)
}
var cache = new Map()
var parseCache = new Map()
All read sites were changed to .has()/.get(), and write sites to boundedCacheSet().
Verification showed that `NODE_ENV=test npx uvu test .test.js` passed 301/301 tests unmodified. A repeated identical call still returns the cached reference. The memory PoC was re-run post-fix, and the heap stayed flat at ~4.9 MB after 5,000, 10,000, 20,000, and 40,000 distinct `since-date` queries (compared to 10.5 → 16.5 → 28.4 → 52.3 MB pre-fix).
DailyCVE Form:
Platform: Node.js
Version: <=4.28.6
Vulnerability: Memory Exhaustion
Severity: Medium
Date: 2026-08-11
Prediction: 2026-08-12
What Undercode Say:
The vulnerability is fixed in version 4.28.7. The CVSS 3.1 score is 7.5 (High). The attack vector is network-based, with low attack complexity, and requires no privileges or user interaction. The impact is on availability only.
Exploit: (Educational Purposes!)
An attacker can exploit this by sending a high volume of distinct, valid `since
for i in {1..20000}; do
node -e "const browserslist = require('browserslist'); browserslist('since 1900-01-${i}');"
done
This would cause the process to allocate memory for each unique query, eventually leading to an out-of-memory (OOM) crash.
Protection:
The primary protection is to upgrade to `browserslist` version 4.28.7 or later. If an immediate upgrade is not possible, consider these workarounds:
– Restrict or sanitize any external input that is used to construct queries passed to browserslist().
– Apply runtime memory limits or process isolation to the build pipeline.
– Avoid using the `since
– Do not rely solely on the `BROWSERSLIST_DISABLE_CACHE` environment variable, as it does not fully mitigate the issue.
Impact:
- Who is affected: Long-running processes that call `browserslist()` with query values that vary across requests or items and are influenced by external input.
- What an attacker achieves: Denial of Service (DoS) via an eventual out-of-memory crash, given sustained traffic over time.
- Conditions required: No authentication is required; it is a volumetric attack, not a single small payload.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
