Skip to content
Fencer Vulns
high 7.5

CVE-2026-73089 json

Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM

published 2026-08-11 2 mo ago modified 2026-09-10 1 mo ago also GHSA-c83g-rgw3-j3cx , EUVD-2026-56600

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.7%
EPSS 0.7% chance of exploitation in 30 days, percentile 51%
public exploits
0
none known

Summary

Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, index.js retains every distinct `(queries, context)` result in cache and every parseQueries() AST in parseCache without a size cap, TTL, or eviction, allowing an attacker who can influence repeated browserslist() query values, including valid since `<year>-<month>-<day>` queries, to bypass the caller-controlled BROWSERSLIST_DISABLE_CACHE mitigation and cause linear memory growth followed by an out-of-memory process crash. This issue is fixed in version 4.28.7.

Patch / fix

  • npm browserslist 4.28.7
  • node-browserslist Debian 14 4.28.7+~cs8.16.65-1

debian advisories DEBIAN-CVE-2026-73089

  • grafana12.4 hummingbird 1 12.4.8-0.1.1.hum1
  • grafana13.1 hummingbird 1 13.1.3-0.1.1.hum1

red hat advisories RHSA-2026:54518RHSA-2026:54517

  • agama-web-ui openSUSE Tumbleweed 24+0.a836cced5-52.1
  • python-pytest-html openSUSE Leap 16.0 4.1.1-bp160.5.1

opensuse advisories openSUSE-SU-2026:11680-1openSUSE-SU-2026:21602-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-73089 updated cvss 7.5

browserslist: Browserslist: Denial of Service via unbounded memory growth from distinct query results

  • Red Hat Node HealthCheck Operator workload-availability/node-healthcheck-rhel9-operator, workload-availability/node-healthcheck-operator-bundle, workload-availability/node-healthcheck-must-gather-rhel9 Red Hat OpenShift Lightspeed openshift-lightspeed/lightspeed-console-plugin-rhel9, openshift-lightspeed/lightspeed-agentic-console-rhel9, openshift-lightspeed/lightspeed-console-plugin-419-rhel9, openshift-lightspeed/lightspeed-console-plugin-pf5-rhel9 Red Hat OpenShift Pipelines openshift-pipelines/pipelines-hub-ui-rhel8, openshift-pipelines/pipelines-hub-ui-rhel9, openshift-pipelines/pipelines-console-plugin-rhel8, openshift-pipelines/pipelines-console-plugin-rhel9, openshift-pipelines/pipelines-console-plugin-pf5-rhel9
    affected: workaround, no fix available
  • Red Hat Ansible Automation Platform 2 automation-eda-controller 1.0.11-1.el9ap, ansible-automation-platform-25/lightspeed-rhel8
    affected: workaround, no fix planned “Will not fix”
  • Red Hat build of Apache Camel - HawtIO 4 browserslist 4.21.5 Red Hat Build of Podman Desktop rh-podman-desktop.git 1.1.0 Red Hat Ceph Storage 9 rhceph/alloy-rhel10 Red Hat Connectivity Link 1 rhcl-1/rhcl-console-plugin-rhel9 Red Hat Enterprise Linux 8 cockpit-composer
    affected: workaround, no fix available
  • Red Hat Enterprise Linux AI (RHEL AI) 3 rust 1.97.1-1.el10, rhelai3/bootc-cuda-rhel9, rhelai3/bootc-rocm-rhel9, rhelai3/bootc-gaudi-rhel9, rhelai3/disk-image-cuda-rhel9
    affected: workaround, no fix available, no fix planned “Will not fix”
  • Red Hat OpenShift AI (RHOAI) rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9 Red Hat OpenShift Container Platform 5 openshift5/nmstate-console-plugin-rhel9 Red Hat Openshift Data Foundation 4 odf4/odf-console-rhel9, odf4/ocs-client-console-rhel9, odf4/odf-multicluster-console-rhel9
    affected: workaround, no fix available
  • Red Hat Single Sign-On 7 browserslist 4.21.5 Red Hat Secrets Management Console for Red Hat OpenShift external-secrets-management/console-plugin-rhel9
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Ansible Automation Platform 2.1 ansible-automation-platform/automation-portal 1787047114
    fixed: vendor fix RHSA-2026:56338
  • Red Hat Ansible Automation Platform 2.2 ansible-automation-platform/automation-portal 1787047188
    fixed: vendor fix RHSA-2026:56357
show 23 more
  • Red Hat Discovery 2 discovery/discovery-ui-rhel9 1786634825
    fixed: vendor fix RHSA-2026:54760
  • Red Hat Edge Manager 1.1 rhem/flightctl-ui-rhel10 1789486181, rhem/flightctl-ui-ocp-rhel9 1789486446, rhem/flightctl-ui-ocp-rhel10 1789486226
    fixed: vendor fix RHSA-2026:68044
  • Red Hat Edge Manager 1.2 rhem/flightctl-ui-rhel9 1789486750, rhem/flightctl-ui-rhel10 1789488111, rhem/flightctl-ui-ocp-rhel9 1789486476, rhem/flightctl-ui-ocp-rhel10 1789485920
    fixed: vendor fix RHSA-2026:68006
  • Red Hat Hardened Images grafana12.4 12.4.8-0.1.1.hum1, grafana13.1 13.1.3-0.1.1.hum1
    fixed: vendor fix RHSA-2026:54518
  • Red Hat Migration Toolkit 1.8 rhmtc/openshift-migration-ui-rhel8 1789546373
    fixed: vendor fix RHSA-2026:68681
  • Red Hat OpenShift AI 2.25 rhoai/odh-dashboard-rhel9 1788312226, rhoai/odh-feature-server-rhel9 1787315684, rhoai/odh-feature-server-rhel9 1792148523, rhoai/odh-mod-arch-model-registry-rhel9 1788312157
    fixed: vendor fix RHSA-2026:65126
  • Red Hat OpenShift AI 3.3 rhoai/odh-feature-server-rhel9 1789745631
    fixed: vendor fix RHSA-2026:73987
  • Red Hat OpenShift AI 3.4 rhoai/odh-dashboard-rhel9 1791861020, rhoai/odh-dashboard-rhel9 1793001801, rhoai/odh-mod-arch-maas-rhel9 1791860708, rhoai/odh-feature-server-rhel9 1791863220, rhoai/odh-mod-arch-automl-rhel9 1791861032, rhoai/odh-mod-arch-gen-ai-rhel9 1791861479, +5 more
    fixed: vendor fix RHSA-2026:92510
  • Red Hat OpenShift Container Platform 4.21 openshift4/nmstate-console-plugin-rhel9 1787590372
    fixed: vendor fix RHSA-2026:60478
  • Red Hat OpenShift Container Platform 4.22 openshift4/nmstate-console-plugin-rhel9 1787744843
    fixed: vendor fix RHSA-2026:60442
  • Red Hat OpenShift Dev Spaces 3.30 devspaces/openvsx-rhel9 1789144269, devspaces/dashboard-rhel9 1789162884
    fixed: vendor fix RHSA-2026:68754
  • Red Hat OpenShift Service Mesh 3.0 openshift-service-mesh/kiali-rhel9 1787076495, openshift-service-mesh/kiali-ossmc-rhel9 1787077028
    fixed: vendor fix RHSA-2026:59548
  • Red Hat OpenShift Service Mesh 3.1 openshift-service-mesh/kiali-rhel9 1787092198, openshift-service-mesh/kiali-ossmc-rhel9 1787075730
    fixed: vendor fix RHSA-2026:59561
  • Red Hat OpenShift Service Mesh 3.2 openshift-service-mesh/kiali-rhel9 1787092255, openshift-service-mesh/kiali-ossmc-rhel9 1787077188
    fixed: vendor fix RHSA-2026:59554
  • Red Hat OpenShift Service Mesh 3.3 openshift-service-mesh/kiali-rhel9 1787077108, openshift-service-mesh/kiali-ossmc-rhel9 1787076322
    fixed: vendor fix RHSA-2026:59566
  • Red Hat OpenShift Service Mesh 3.4 openshift-service-mesh/kiali-rhel9 1787165683, openshift-service-mesh/kiali-ossmc-rhel9 1787166293
    fixed: vendor fix RHSA-2026:59583
  • Red Hat Quay 3.9 quay/quay-rhel8 1788595574
    fixed: vendor fix RHSA-2026:65514
  • Red Hat Quay 3.10 quay/quay-rhel8 1788561841
    fixed: vendor fix RHSA-2026:66084
  • Red Hat Quay 3.12 quay/quay-rhel8 1788594376
    fixed: vendor fix RHSA-2026:66523
  • Red Hat Quay 3.14 quay/quay-rhel8 1788593843
    fixed: vendor fix RHSA-2026:70267
  • Red Hat Quay 3.15 quay/quay-rhel8 1788191755
    fixed: vendor fix RHSA-2026:63307
  • Red Hat Satellite 6.18 satellite/iop-vulnerability-frontend-rhel9 1789660969, satellite/iop-host-inventory-frontend-rhel9 1788322243
    fixed: vendor fix RHSA-2026:63373
  • Red Hat Satellite 6.19 satellite/iop-advisor-frontend-rhel9 1789659565, satellite/iop-vulnerability-frontend-rhel9 1789660983, satellite/iop-host-inventory-frontend-rhel9 1788260941
    fixed: vendor fix RHSA-2026:68748

2 more fixed, 40 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
2 mo ago

Exploit prediction

0.66% chance of exploitation in the next 30 days, higher than 51% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
npm browserslist
<4.28.7
4.28.7

Affected products

  • browserslist browserslist

Classification

Weakness
  • CWE-770 Allocation of Resources Without Limits or Throttling

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.