CVE-2026-73089High· 7.5▾ TwilightBrowserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, index.js retains every distinct `(queries, context)` result in cache and every parseQueries() AST in parseCac…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 1.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.4%
Last analysed / modified upstream
0.4% → 0.7%
Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, index.js retains every distinct (queries, context) result in cache and every parseQueries() AST in parseCache without a size cap, TTL, or eviction, allowing an attacker who can influence repeated browserslist() query values, including valid since <year>-<month>-<day> queries, to bypass the caller-controlled BROWSERSLIST_DISABLE_CACHE mitigation and cause linear memory growth followed by an out-of-memory process crash. This issue is fixed in version 4.28.7.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
browserslist <= 4.28.6Patched in:
browserslist 4.28.7Source: https://github.com/advisories/GHSA-c83g-rgw3-j3cx
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-73088High· 7.5Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools
CVE-2026-73646High· 7.5PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree
CVE-2026-67320High· 7.4axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy
CVE-2026-12590Medium· 5.9body-parser: body-parser: Denial of Service via invalid limit option (CVE-2026-12590)
CVE-2026-95502Medium· 5.3A Git server that Grafana's Git Sync (provisioning) is configured to use can exhaust Grafana's memory by returning oversized or highly compressed responses (uncontrolled resource consumption)
CVE-2026-33374Medium· 6.5The Prometheus rule conversion API endpoints in Grafana do not limit request body size, allowing authenticated users to trigger unbounded memory allocations that can crash the server through out-of-memory conditions.