CVE-2026-73089: Browserslist unbounded cache memory growth via distinct query results

CVE-2026-73089 · Severity: high · CVSS 7.5 · Published 2026-08-11

Browserslist is a widely-used JavaScript library that resolves browser version ranges for development tools and build systems. The library caches query results indefinitely without size limits; an attacker sending a high volume of varying but valid queries can force the cache to grow unbounded, consuming gigabytes of memory until the host process crashes. This affects any long-running service (web server, daemon, CI worker) that accepts user-influenced query inputs.

Technologies: browserslist (npm). Vendors: npm.

Quick answers

Is CVE-2026-73089 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-73089 being exploited in the wild.
How severe is CVE-2026-73089?
High severity, with a CVSS score of 7.5, published 11 August 2026.
Which products and versions are affected?
browserslist (npm) <= 4.28.6, SEMVER:introduced=0,fixed=4.28.7.
Is there a fix for CVE-2026-73089?
Yes. browserslist (npm): upgrade to 4.28.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-73089 attacked?
It is attacked over the network.
Am I affected by CVE-2026-73089?
Check whether you run browserslist (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • browserslist (npm): upgrade to 4.28.7 or later
    npm install browserslist@4.28.7

Technical details

The vulnerability exists in index.js where two plain JavaScript objects—`cache` and `parseCache`—store results without any size cap, TTL, or eviction mechanism. Every distinct (queries, context) tuple is cached permanently. The `since <year>-<month>-<day>` query type accepts any digit combination (Date.UTC normalizes out-of-range values), creating an effectively unbounded space of distinct 17-byte cache keys. Each resolves to an ~8.5 KB result, achieving ~150x heap amplification. Measured testing showed 20,000 distinct queries consuming over 50 MB (vs. 330 KB input), scaling linearly to 52.3 MB at 40,000 queries. The sole application-level mitigation is the BROWSERSLIST_DISABLE_CACHE environment variable, which is controlled by the calling application, not the attacker. The fix (4.28.7+) replaces plain objects with LRU-like Map structures bounded to 500 entries, evicting oldest entries on overflow. Post-patch testing confirms heap remains flat at ~4.9 MB across 40,000 distinct queries.

Affected products

  • browserslist browserslist <= 4.28.6

Identifiers

  • CVE-2026-73089
  • GHSA-c83g-rgw3-j3cx

Timeline

  • 2026-09-01: disclosed: Published on GitHub Advisory Database
  • 2026-09-01: patched: Fix released in v4.28.7

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.