Executive brief
Browserslist is a popular JavaScript library used to determine which browser versions a web application needs to support. A regular expression processing flaw in the library can be exploited to cause a denial of service by parsing specially crafted queries, consuming excessive CPU and making the library unresponsive during build or deployment processes.
Technical details
The vulnerability is a Regular Expression Denial of Service (ReDoS) in browserslist's query parsing logic, caused by vulnerable regex patterns containing the problematic construct \d*\.?\d+. The library processes user-supplied or configuration-based browser query strings without proper validation. An attacker can craft a malicious query string that triggers catastrophic backtracking in the regex engine, causing excessive CPU consumption and denial of service. No authentication or special privileges are required—any code that processes untrusted browserslist queries is vulnerable. The fix involves replacing the vulnerable regex patterns with non-backtracking alternatives (e.g., \d+|\d*\.\d+), and patches are available in version 4.16.5 and later.
Affected products
- browserslist browserslist 4.0.0 through 4.16.4
Timeline
- 2021-04-28: disclosed
- 2021-04-22: patched: Fix merged in PR #593
- 2021-05-24: advisory