CVE-2026-73089: Browserslist DoS Vulnerability

CVE-2026-73089 Overview

CVE-2026-73089 is an unbounded resource consumption vulnerability in Browserslist, a widely-used configuration tool for sharing target browsers and Node.js versions between front-end tools. Versions prior to 4.28.7 retain every distinct (queries, context) result in cache and every parseQueries() abstract syntax tree in parseCache without a size cap, time-to-live (TTL), or eviction policy. An attacker able to influence repeated browserslist() query values, including valid since <year>-<month>-<day> queries, can bypass the caller-controlled BROWSERSLIST_DISABLE_CACHE mitigation. The result is linear memory growth followed by an out-of-memory (OOM) process crash. The issue is classified as [CWE-770: Allocation of Resources Without Limits or Throttling].

Critical Impact
Remote attackers can trigger denial of service through memory exhaustion by supplying attacker-influenced query values to any application invoking browserslist() with untrusted input.

Affected Products

Browserslist versions prior to 4.28.7
Front-end tooling and build systems that pass user-controllable input into browserslist()
Node.js applications integrating Browserslist as a runtime dependency

Discovery Timeline

2026-08-11 - CVE-2026-73089 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-73089

Vulnerability Analysis

Browserslist maintains two internal in-memory stores in index.js: cache for (queries, context) results and parseCache for parsed abstract syntax trees from parseQueries(). Neither store enforces a maximum entry count, TTL, or eviction policy. Every distinct query string produces a new persistent entry.

The BROWSERSLIST_DISABLE_CACHE environment mitigation is caller-controlled and does not prevent library-internal cache growth when attacker-influenced queries reach browserslist(). This design makes the memory footprint a linear function of the number of unique queries observed during the process lifetime.

An attacker who can influence query values, including semantically valid queries such as since 2020-01-01 with varying dates, generates unbounded unique cache keys. Repeated invocations drive the Node.js process toward its heap limit, culminating in an out-of-memory crash.

Root Cause

The root cause is missing bounds on cache growth in index.js. The original implementation declared var cache = {} and var parseCache = {} as plain objects populated without any eviction logic, matching the pattern described in [CWE-770].

Attack Vector

Exploitation requires the attacker to influence values passed to browserslist(). Any downstream tool exposing a network-reachable interface that forwards user input into Browserslist queries becomes an amplifier for the flaw. No authentication or user interaction is required when such an interface exists.

javascript

// Patch from index.js - Fix unbounded memory growth
-var cache = {}
-var parseCache = {}
+var CACHE_MAX_ENTRIES = 500
+
+function boundedCacheSet(map, key, value) {
+  if (map.size >= CACHE_MAX_ENTRIES) {
+    map.delete(map.keys().next().value)
+  }
+  map.set(key, value)
+}
+
+var cache = new Map()
+var parseCache = new Map()

 function browserslist(queries, opts) {
   opts = prepareOpts(opts)

Source: GitHub Commit f2931a3

The patch replaces the unbounded plain objects with Map instances and introduces boundedCacheSet(), which enforces CACHE_MAX_ENTRIES = 500 using first-in-first-out (FIFO) eviction.

Detection Methods for CVE-2026-73089

Indicators of Compromise

Node.js process crashes with JavaScript heap out of memory or FATAL ERROR: Reached heap limit messages in application logs.
Steadily rising resident set size (RSS) for processes that invoke browserslist() on user-supplied input.
Repeated inbound requests containing varying since <year>-<month>-<day> style query fragments in query strings, headers, or JSON bodies.

Detection Strategies

Inventory package.json and package-lock.json files across build systems and production services for Browserslist versions below 4.28.7.
Monitor Node.js runtime metrics for sustained heap growth without corresponding workload increase.
Instrument code paths that forward untrusted input into browserslist() and log the diversity of query values observed.

Monitoring Recommendations

Alert when Node.js process heap usage exceeds baseline thresholds or when V8 emits OOM diagnostics.
Track dependency drift using software composition analysis (SCA) tools to flag vulnerable Browserslist releases in CI/CD pipelines.
Correlate application restarts caused by OOM conditions with upstream request patterns to identify potential abuse.

How to Mitigate CVE-2026-73089

Immediate Actions Required

Upgrade Browserslist to version 4.28.7 or later across all direct and transitive dependencies.
Audit application code for locations where untrusted input is forwarded into browserslist() and validate or normalize query values.
Restart long-running Node.js processes after upgrading to reset any pre-existing cache growth.

Patch Information

The vulnerability is fixed in Browserslist 4.28.7. The fix, tracked in GitHub Security Advisory GHSA-c83g-rgw3-j3cx, introduces bounded Map-based caches with FIFO eviction at 500 entries. See the GitHub Release 4.28.7 notes for full change details.

Workarounds

Restrict or sanitize user input reaching browserslist() to a fixed allow-list of query strings.
Deploy process-level memory limits and automatic restart policies to contain OOM impact until patching completes.
Isolate Browserslist evaluation into short-lived worker processes that are recycled after a bounded number of invocations.

bash

# Upgrade Browserslist to the patched version
npm install browserslist@^4.28.7

# Verify the resolved version across the dependency tree
npm ls browserslist

# Optional: enforce a Node.js heap ceiling for defense in depth
node --max-old-space-size=512 app.js