{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3abrowserslistbrowserslistnode.js/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:browserslist:browserslist:*:*:*:*:*:node.js:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-73089"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["browserslist (\u003c= 4.28.6)"],"_cs_severities":["low"],"_cs_tags":["denial-of-service","memory-exhaustion","javascript","nodejs","vulnerability","prototype-pollution","supply-chain"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe Browserslist package (up to and including v4.28.6) contains a memory management vulnerability in its internal query and parse caches. The application maintains two objects, \u003ccode\u003ecache\u003c/code\u003e and \u003ccode\u003eparseCache\u003c/code\u003e, which store results indexed by query keys generated via \u003ccode\u003eJSON.stringify()\u003c/code\u003e. These caches lack size constraints, time-to-live (TTL) policies, or eviction mechanisms, and are not cleared by the \u003ccode\u003ebrowserslist.clearCaches()\u003c/code\u003e function.\u003c/p\u003e\n\u003cp\u003eIn long-running Node.js processes such as web servers or CI workers, an attacker who can influence the query strings passed to \u003ccode\u003ebrowserslist()\u003c/code\u003e can cause unbounded memory growth. Specifically, the \u003ccode\u003esince \u0026lt;year\u0026gt;-\u0026lt;month\u0026gt;-\u0026lt;day\u0026gt;\u003c/code\u003e query pattern allows for a large space of valid, distinct keys. By sending a high volume of unique requests, an attacker can force the accumulation of cache entries until the process exhausts available heap memory, resulting in an out-of-memory (OOM) crash. Analysis showed an approximately 150x memory amplification factor, where 20,000 distinct queries consumed over 50 MB of permanent heap space.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies a target application utilizing Browserslist in a long-running process (e.g., web server or CI pipeline) that accepts user-influenced input for browser queries.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a series of distinct, syntactically valid \u003ccode\u003esince \u0026lt;year\u0026gt;-\u0026lt;month\u0026gt;-\u0026lt;day\u0026gt;\u003c/code\u003e query strings.\u003c/li\u003e\n\u003cli\u003eAttacker sends a high volume of requests to the target, each containing a unique date variation to ensure the cache key is novel.\u003c/li\u003e\n\u003cli\u003eThe target application passes these queries to the \u003ccode\u003ebrowserslist()\u003c/code\u003e function.\u003c/li\u003e\n\u003cli\u003eThe library generates a unique \u003ccode\u003ecacheKey\u003c/code\u003e using \u003ccode\u003eJSON.stringify()\u003c/code\u003e for each request.\u003c/li\u003e\n\u003cli\u003eBrowserslist stores the resulting data in the unbounded \u003ccode\u003ecache\u003c/code\u003e and \u003ccode\u003eparseCache\u003c/code\u003e objects.\u003c/li\u003e\n\u003cli\u003eMemory usage of the process grows linearly with the number of unique queries.\u003c/li\u003e\n\u003cli\u003eUpon reaching memory limits, the process crashes due to an OOM condition, resulting in a denial-of-service.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in a denial-of-service via process termination. This vulnerability impacts long-running Node.js applications that process external inputs influencing browser queries. The attack requires a sustained, high-volume request stream rather than a single malicious payload, which characterizes it as a volumetric DoS.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade the \u003ccode\u003ebrowserslist\u003c/code\u003e package to a version that implements the bounded cache fix (e.g., \u0026gt; 4.28.6).\u003c/li\u003e\n\u003cli\u003eIf an immediate upgrade is not possible, review application code to identify if user input influences \u003ccode\u003ebrowserslist()\u003c/code\u003e calls and implement an application-layer cache proxy or query validation to restrict the variety of permitted query strings.\u003c/li\u003e\n\u003cli\u003eEnsure that if \u003ccode\u003eBROWSERSLIST_DISABLE_CACHE\u003c/code\u003e is used as a workaround, the impact on performance is measured against the expected request load.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-09-01T18:00:44Z","date_published":"2026-09-01T18:00:21Z","id":"https://feed.craftedsignal.io/briefs/2026-09-browserslist-oom/","summary":"The Browserslist package is vulnerable to a volumetric denial-of-service attack due to a missing cache eviction policy in its internal query result storage, leading to unbounded heap growth and potential OOM crashes in long-running processes.","title":"Browserslist Unbounded Memory Growth via Cache Exhaustion","url":"https://feed.craftedsignal.io/briefs/2026-09-browserslist-oom/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:browserslist:browserslist:*:*:*:*:*:node.js:*:*","version":"https://jsonfeed.org/version/1.1"}