# CVE-2021-23364: browserslist regular expression denial of service

Source: https://junglewise.ai/threats/cve-2021-23364-browserslist-regular-expression-denial-of-service  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2021-05-24. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2021-23364 · Severity: low · CVSS 3.1 · Published 2021-05-24

Browserslist is a popular JavaScript library used to determine which browser versions a web application needs to support. A regular expression processing flaw in the library can be exploited to cause a denial of service by parsing specially crafted queries, consuming excessive CPU and making the library unresponsive during build or deployment processes.

Technologies: [browserslist (npm)](https://junglewise.ai/threats/technologies/browserslist). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2021-23364 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2021-23364 being exploited in the wild.

**How severe is CVE-2021-23364?** Low severity, with a CVSS score of 3.1, published 24 May 2021.

**Which products and versions are affected?** browserslist (npm) SEMVER:introduced=4.0.0,fixed=4.16.5.

**Is there a fix for CVE-2021-23364?** Yes. browserslist (npm): upgrade to 4.16.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2021-23364 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2021-23364?** Check whether you run browserslist (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- browserslist (npm): upgrade to 4.16.5 or later

  ```sh
  npm install browserslist@4.16.5
  ```


## Technical details

The vulnerability is a Regular Expression Denial of Service (ReDoS) in browserslist's query parsing logic, caused by vulnerable regex patterns containing the problematic construct \d*\.?\d+. The library processes user-supplied or configuration-based browser query strings without proper validation. An attacker can craft a malicious query string that triggers catastrophic backtracking in the regex engine, causing excessive CPU consumption and denial of service. No authentication or special privileges are required—any code that processes untrusted browserslist queries is vulnerable. The fix involves replacing the vulnerable regex patterns with non-backtracking alternatives (e.g., \d+|\d*\.\d+), and patches are available in version 4.16.5 and later.

## Affected products

- browserslist browserslist 4.0.0 through 4.16.4

## Identifiers

- CVE-2021-23364
- GHSA-w8qv-6jwh-64r5

## Timeline

- 2021-04-28: disclosed
- 2021-04-22: patched: Fix merged in PR #593
- 2021-05-24: advisory

## References

- [https://github.com/browserslist/browserslist/pull/593](https://github.com/browserslist/browserslist/pull/593)

## Related threats

- [Browserslist unbounded cache memory growth via distinct query results](https://junglewise.ai/threats/cve-2026-73089-browserslist-unbounded-cache-memory-growth-via-distinct-query)
- [Browserslist DoS crash via untrusted stats file in normalizeStats](https://junglewise.ai/threats/cve-2026-73088-browserslist-dos-crash-via-untrusted-stats-file-in-normalizestats)