Go to packages list

browserslist

Ecosystem: npm

Downloads: 873.84 Mln

Vulnerabilities from the last (months)
  • 0CriticalAffects 0 versions
  • 2HighAffects 2 versions
  • 0MediumAffects 0 versions
  • 1ModerateAffects 1 version
  • 0LowAffects 0 versions
Severity distribution (all time)
3vulnerabilities
  • Critical0 (0.0%)
  • High2 (66.7%)
  • Medium0 (0.0%)
  • Moderate1 (33.3%)
  • Low0 (0.0%)

Monthly breakdown

  • Critical
  • High
  • Medium
  • Moderate
  • Low
  • 2 vulnerabilities
    • Critical: 0
    • High: 2
    • Medium: 0
    • Moderate: 0
    • Low: 0
  • 1 vulnerabilities
    • Critical: 0
    • High: 0
    • Medium: 0
    • Moderate: 1
    • Low: 0

Vulnerabilities (3)

Known vulnerabilities affecting browserslist, based on data from OSV.

Vulnerabilities affecting browserslist
IDSeveritySummaryAffected versionsPublishedSource
GHSA-73wf-gq98-2v4gHighBrowserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)## Vulnerability Details **File**: `node.js` **Function**: `normalizeStats()` (line ~214), reached from `getStat()` (called **unconditionally** on every `browserslist()` call) and `loadStat()` ### Root Cause ```js function normalizeStats(data, stats) { if (!data) { data = {} } if (stats && 'dataByBrowser' in stats) { stats = stats.dataByBrowser } if (typeof stats !== 'object') return undefined var normalized = {} for (var i in stats) { var versions = Object.keys(stats[i]) if (versions.length === 1 && data[i] && data[i].versions.length === 1) { var normal = data[i].ve
  • < 4.28.7
GitHub (opens in a new tab)
GHSA-c83g-rgw3-j3cxHighBrowserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM## Vulnerability Details **File**: `index.js` **Location**: `cache` (browserslist()'s result cache, line ~402) and `parseCache` (parseQueries()'s AST cache) ### Root Cause ```js var cache = {} var parseCache = {} function browserslist(queries, opts) { ... var cacheKey = JSON.stringify([queries, context]) if (cache[cacheKey]) return cache[cacheKey] ... if (!env.env.BROWSERSLIST_DISABLE_CACHE) { cache[cacheKey] = result } return result } function parseQueries(queries) { var cacheKey = JSON.stringify(queries) if (cacheKey in parseCache) return parseCache[cacheKey] var result
  • < 4.28.7
GitHub (opens in a new tab)
GHSA-w8qv-6jwh-64r5ModerateRegular Expression Denial of Service in browserslistThe package browserslist from 4.0.0 and before 4.16.5 are vulnerable to Regular Expression Denial of Service (ReDoS) during parsing of queries.
  • >= 4.0.0, < 4.16.5
GitHub (opens in a new tab)
  • GHSA-73wf-gq98-2v4gHigh
    Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)
    • < 4.28.7
    GitHub (opens in a new tab)

    ## Vulnerability Details **File**: `node.js` **Function**: `normalizeStats()` (line ~214), reached from `getStat()` (called **unconditionally** on every `browserslist()` call) and `loadStat()` ### Root Cause ```js function normalizeStats(data, stats) { if (!data) { data = {} } if (stats && 'dataByBrowser' in stats) { stats = stats.dataByBrowser } if (typeof stats !== 'object') return undefined var normalized = {} for (var i in stats) { var versions = Object.keys(stats[i]) if (versions.length === 1 && data[i] && data[i].versions.length === 1) { var normal = data[i].ve

    CVE: CVE-2026-73088

  • GHSA-c83g-rgw3-j3cxHigh
    Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM
    • < 4.28.7
    GitHub (opens in a new tab)

    ## Vulnerability Details **File**: `index.js` **Location**: `cache` (browserslist()'s result cache, line ~402) and `parseCache` (parseQueries()'s AST cache) ### Root Cause ```js var cache = {} var parseCache = {} function browserslist(queries, opts) { ... var cacheKey = JSON.stringify([queries, context]) if (cache[cacheKey]) return cache[cacheKey] ... if (!env.env.BROWSERSLIST_DISABLE_CACHE) { cache[cacheKey] = result } return result } function parseQueries(queries) { var cacheKey = JSON.stringify(queries) if (cacheKey in parseCache) return parseCache[cacheKey] var result

    CVE: CVE-2026-73089

  • GHSA-w8qv-6jwh-64r5Moderate
    Regular Expression Denial of Service in browserslist
    • >= 4.0.0, < 4.16.5
    GitHub (opens in a new tab)

    The package browserslist from 4.0.0 and before 4.16.5 are vulnerable to Regular Expression Denial of Service (ReDoS) during parsing of queries.

    CVE: CVE-2021-23364

Showing 1-3 of 3 vulnerabilities