Executive brief
baseline-browser-mapping is a Node.js library that maps web browser compatibility data for development tools. When the library receives invalid or conflicting input parameters, it terminates the entire process instead of raising a recoverable error. This allows an attacker to crash applications using this library, disrupting availability and potentially affecting dependent services or build pipelines.
Technical details
The vulnerability is a control flow defect (CWE-705) in which the library calls process.exit() for parameter validation failures rather than throwing an exception. The vulnerable code path is in src/index.ts, where invalid or conflicting input parameters trigger an unhandled process termination. This affects baseline-browser-mapping versions 2.0.0 through 2.10.x. An attacker can craft malicious input to the library's API functions to cause the Node.js process to exit immediately, resulting in a denial of service. No authentication or elevated privileges are required; the vulnerability is reachable via direct API calls. The fix was applied in version 2.11.0, which now properly throws exceptions instead of terminating the process.
Affected products
- web-platform-dx baseline-browser-mapping 2.0.0 through 2.10.x
Timeline
- 2026-08-13: disclosed: Published to GitHub Advisory Database and NVD
- 2026-08-13: patched: Patch released in version 2.11.0
References
- https://github.com/web-platform-dx/baseline-browser-mapping/pull/137/changes
- https://github.com/web-platform-dx/baseline-browser-mapping/blob/b7881aa61c8a057e24468ab5ee18c5ecedbbf691/src/index.ts
- https://www.npmjs.com/package/baseline-browser-mapping
- https://github.com/web-platform-dx/baseline-browser-mapping/pull/137
- https://github.com/web-platform-dx/baseline-browser-mapping/commit/de733e2d8959559f7bb255d5927f3afcb6f31589