CVE-2021-23364: Browserslist Project Browserslist

Medium severity, CVSS 5.3. EPSS: 2.5% chance of exploitation in the next 30 days.

The package browserslist from 4.0.0 and before 4.16.5 are vulnerable to Regular Expression Denial of Service (ReDoS) during parsing of queries.

Affected products

• Browserslist Project Browserslist: from 4.0.0, before 4.16.5 (fixed in 4.16.5)

Published 2021-04-28. Last modified 2026-06-17.