CVE-2026-73089

Received Received - Intake

Memory Exhaustion in Browserslist via Unbounded Cache Growth

Publication date: 2026-08-11

Last updated on: 2026-08-13

Assigner: GitHub, Inc.

Description

Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, index.js retains every distinct `(queries, context)` result in cache and every parseQueries() AST in parseCache without a size cap, TTL, or eviction, allowing an attacker who can influence repeated browserslist() query values, including valid since `<year>-<month>-<day>` queries, to bypass the caller-controlled BROWSERSLIST_DISABLE_CACHE mitigation and cause linear memory growth followed by an out-of-memory process crash. This issue is fixed in version 4.28.7.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-11

Last Modified

2026-08-13

Generated

2026-08-31

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-30

NVD

CVE-2026-73089

EUVD

EUVD-2026-56600

Affected Vendors & Products

Vendor	Product	Version / Range
browserslist	browserslist	to 4.28.7 (exc)
browserslist	browserslist	4.28.7

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

CVE-2026-73089 is a memory exhaustion vulnerability in the browserslist npm package versions 4.28.6 and earlier. The issue occurs because the browserslist() function caches every unique query-context pair indefinitely in two caches without size limits or eviction mechanisms. Attackers can exploit this by sending many distinct queries, such as varying 'since <year>-<month>-<day>' queries, which generate unique cache keys. Each query result is large (~8.5 KB), causing linear memory growth. Eventually, the process crashes due to out-of-memory conditions.

Detection Guidance

To detect this vulnerability, monitor memory usage in long-running processes that use browserslist versions <= 4.28.6. Check for linear memory growth when processing repeated distinct queries like 'since <year>-<month>-<day>'. Use tools like 'top', 'htop', or 'ps' to observe memory consumption in affected applications.

Impact Analysis

This vulnerability primarily affects long-running processes like servers, daemons, or CI workers that repeatedly call browserslist() with user-influenced query values. An attacker could send a high volume of distinct queries to cause memory exhaustion, leading to crashes or degraded performance. Systems running browserslist in automated environments are most at risk, especially if external input influences the queries.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It causes out-of-memory crashes in long-running processes due to unbounded memory growth from caching distinct queries. While not a compliance violation itself, such crashes could disrupt systems handling sensitive data, potentially leading to service unavailability or data processing interruptions.

Mitigation Strategies

Upgrade to browserslist version 4.28.7 or later. If upgrading is not immediately possible, implement a workaround by setting BROWSERSLIST_DISABLE_CACHE=1 in your environment to disable caching. For long-running processes, consider adding rate limiting or input validation to prevent excessive distinct queries.

Hi! I’m here to help you understand CVE-2026-73089. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70