# CVE-2026-73089: Browserslist unbounded cache memory growth via distinct query results

Source: https://junglewise.ai/threats/cve-2026-73089-browserslist-unbounded-cache-memory-growth-via-distinct-query  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-11. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-73089 · Severity: high · CVSS 7.5 · Published 2026-08-11

Browserslist is a widely-used JavaScript library that resolves browser version ranges for development tools and build systems. The library caches query results indefinitely without size limits; an attacker sending a high volume of varying but valid queries can force the cache to grow unbounded, consuming gigabytes of memory until the host process crashes. This affects any long-running service (web server, daemon, CI worker) that accepts user-influenced query inputs.

Technologies: [browserslist (npm)](https://junglewise.ai/threats/technologies/browserslist). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-73089 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-73089 being exploited in the wild.

**How severe is CVE-2026-73089?** High severity, with a CVSS score of 7.5, published 11 August 2026.

**Which products and versions are affected?** browserslist (npm) <= 4.28.6, SEMVER:introduced=0,fixed=4.28.7.

**Is there a fix for CVE-2026-73089?** Yes. browserslist (npm): upgrade to 4.28.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-73089 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-73089?** Check whether you run browserslist (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- browserslist (npm): upgrade to 4.28.7 or later

  ```sh
  npm install browserslist@4.28.7
  ```


## Technical details

The vulnerability exists in index.js where two plain JavaScript objects—`cache` and `parseCache`—store results without any size cap, TTL, or eviction mechanism. Every distinct (queries, context) tuple is cached permanently. The `since <year>-<month>-<day>` query type accepts any digit combination (Date.UTC normalizes out-of-range values), creating an effectively unbounded space of distinct 17-byte cache keys. Each resolves to an ~8.5 KB result, achieving ~150x heap amplification. Measured testing showed 20,000 distinct queries consuming over 50 MB (vs. 330 KB input), scaling linearly to 52.3 MB at 40,000 queries. The sole application-level mitigation is the BROWSERSLIST_DISABLE_CACHE environment variable, which is controlled by the calling application, not the attacker. The fix (4.28.7+) replaces plain objects with LRU-like Map structures bounded to 500 entries, evicting oldest entries on overflow. Post-patch testing confirms heap remains flat at ~4.9 MB across 40,000 distinct queries.

## Affected products

- browserslist browserslist <= 4.28.6

## Identifiers

- CVE-2026-73089
- GHSA-c83g-rgw3-j3cx

## Timeline

- 2026-09-01: disclosed: Published on GitHub Advisory Database
- 2026-09-01: patched: Fix released in v4.28.7

## References

- [https://api.github.com/users/iaohkut-from-NightWolf-Team](https://api.github.com/users/iaohkut-from-NightWolf-Team)
- [https://github.com/iaohkut-from-NightWolf-Team](https://github.com/iaohkut-from-NightWolf-Team)
- [https://api.github.com/users/iaohkut-from-NightWolf-Team/gists%7B/gist_id%7D](https://api.github.com/users/iaohkut-from-NightWolf-Team/gists%7B/gist_id%7D)
- [https://api.github.com/users/iaohkut-from-NightWolf-Team/repos](https://api.github.com/users/iaohkut-from-NightWolf-Team/repos)
- [https://avatars.githubusercontent.com/u/286391906?v=4](https://avatars.githubusercontent.com/u/286391906?v=4)
- [https://api.github.com/users/iaohkut-from-NightWolf-Team/events%7B/privacy%7D](https://api.github.com/users/iaohkut-from-NightWolf-Team/events%7B/privacy%7D)

## Related threats

- [Browserslist DoS crash via untrusted stats file in normalizeStats](https://junglewise.ai/threats/cve-2026-73088-browserslist-dos-crash-via-untrusted-stats-file-in-normalizestats)
- [browserslist regular expression denial of service](https://junglewise.ai/threats/cve-2021-23364-browserslist-regular-expression-denial-of-service)