Junglewise Threat Intelligence

CVE-2026-73089: Browserslist unbounded cache memory growth via distinct query results

CVE-2026-73089 · Severity: high · CVSS 7.5 · Published 2026-09-01

Executive brief

Browserslist is a widely-used JavaScript library that resolves browser version ranges for development tools and build systems. The library caches query results indefinitely without size limits; an attacker sending a high volume of varying but valid queries can force the cache to grow unbounded, consuming gigabytes of memory until the host process crashes. This affects any long-running service (web server, daemon, CI worker) that accepts user-influenced query inputs.

Technical details

The vulnerability exists in index.js where two plain JavaScript objects—`cache` and `parseCache`—store results without any size cap, TTL, or eviction mechanism. Every distinct (queries, context) tuple is cached permanently. The `since <year>-<month>-<day>` query type accepts any digit combination (Date.UTC normalizes out-of-range values), creating an effectively unbounded space of distinct 17-byte cache keys. Each resolves to an ~8.5 KB result, achieving ~150x heap amplification. Measured testing showed 20,000 distinct queries consuming over 50 MB (vs. 330 KB input), scaling linearly to 52.3 MB at 40,000 queries. The sole application-level mitigation is the BROWSERSLIST_DISABLE_CACHE environment variable, which is controlled by the calling application, not the attacker. The fix (4.28.7+) replaces plain objects with LRU-like Map structures bounded to 500 entries, evicting oldest entries on overflow. Post-patch testing confirms heap remains flat at ~4.9 MB across 40,000 distinct queries.

Affected products

  • browserslist browserslist <= 4.28.6

Timeline

  • 2026-09-01: disclosed: Published on GitHub Advisory Database
  • 2026-09-01: patched: Fix released in v4.28.7

References

Related threats