CVE-2026-73089 Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM
An attacker can cause an out-of-memory crash in Browserslist by supplying distinct query inputs that bypass cache limits, affecting applications using the library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-73089?
CVE-2026-73089 is a high-severity denial of service vulnerability in browserslist, published on 11 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, index.js retains every distinct `(queries, context)` result in cache and every parseQueries() AST in parseCache without a size cap, TTL, or eviction, allowing an attacker who can influence repeated browserslist() query values, including valid since `<year>-<month>-<day>` queries, to bypass the caller-controlled BROWSERSLIST_DISABLE_CACHE mitigation and cause linear memory growth followed by an out-of-memory process crash. This issue is fixed in version 4.28.7.
Weakness: CWE-770
Which versions are affected by CVE-2026-73089?
2 open source packages ship an affected version, including browserslist.
| Package | Affected | Fixed in |
|---|---|---|
browserslist npm | All versions | 4.28.7 |
browserslist npm | All versions | 4.28.7 |
How do I fix CVE-2026-73089?
Upgrade browserslist to 4.28.7 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-73089 being exploited?
There is no known exploitation of CVE-2026-73089 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-IH43299, CLEANSTART-2026-LC51656, CLEANSTART-2026-NW83834, CLSA-2026-1790175511, CLSA-2026-1790175574, CLSA-2026-1790950178 and 27 more.