Is CVE-2021-23364 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2021-23364 being exploited in the wild.

How severe is CVE-2021-23364?

Low severity, with a CVSS score of 3.1, published 24 May 2021.

Which products and versions are affected?

browserslist (npm) SEMVER:introduced=4.0.0,fixed=4.16.5.

Is there a fix for CVE-2021-23364?

Yes. browserslist (npm): upgrade to 4.16.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2021-23364 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2021-23364?

Check whether you run browserslist (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2021-23364: browserslist regular expression denial of service

CVE-2021-23364 · Severity: low · CVSS 3.1 · Published 2021-05-24

Browserslist is a popular JavaScript library used to determine which browser versions a web application needs to support. A regular expression processing flaw in the library can be exploited to cause a denial of service by parsing specially crafted queries, consuming excessive CPU and making the library unresponsive during build or deployment processes.

Technologies: browserslist (npm). Vendors: npm.

Quick answers

Is CVE-2021-23364 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2021-23364 being exploited in the wild.
How severe is CVE-2021-23364?: Low severity, with a CVSS score of 3.1, published 24 May 2021.
Which products and versions are affected?: browserslist (npm) SEMVER:introduced=4.0.0,fixed=4.16.5.
Is there a fix for CVE-2021-23364?: Yes. browserslist (npm): upgrade to 4.16.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2021-23364 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2021-23364?: Check whether you run browserslist (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

browserslist (npm): upgrade to 4.16.5 or later
```
npm install browserslist@4.16.5
```

Technical details

The vulnerability is a Regular Expression Denial of Service (ReDoS) in browserslist's query parsing logic, caused by vulnerable regex patterns containing the problematic construct \d*\.?\d+. The library processes user-supplied or configuration-based browser query strings without proper validation. An attacker can craft a malicious query string that triggers catastrophic backtracking in the regex engine, causing excessive CPU consumption and denial of service. No authentication or special privileges are required—any code that processes untrusted browserslist queries is vulnerable. The fix involves replacing the vulnerable regex patterns with non-backtracking alternatives (e.g., \d+|\d*\.\d+), and patches are available in version 4.16.5 and later.

Affected products

browserslist browserslist 4.0.0 through 4.16.4

Identifiers

CVE-2021-23364
GHSA-w8qv-6jwh-64r5

Timeline

2021-04-28: disclosed
2021-04-22: patched: Fix merged in PR #593
2021-05-24: advisory

References

https://github.com/browserslist/browserslist/pull/593

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.