CVE-2026-73089: Browserslist

High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days.

Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, index.js retains every distinct `(queries, context)` result in cache and every parseQueries() AST in parseCache without a size cap, TTL, or eviction, allowing an attacker who can influence repeated browserslist() query values, including valid since `<year>-<month>-<day>` queries, to bypass the caller-controlled BROWSERSLIST_DISABLE_CACHE mitigation and cause linear memory growth followed by an out-of-memory process crash. This issue is fixed in version 4.28.7.

Affected products

• Browserslist Browserslist: before 4.28.7 (fixed in 4.28.7)

Published 2026-08-11. Last modified 2026-09-09.