Skip to content
Threat Feed
Subscribe

Product

Browserslist (<= 4.28.6)

1 brief RSS
low advisory

Browserslist Unbounded Memory Growth via Cache Exhaustion

The Browserslist package is vulnerable to a volumetric denial-of-service attack due to a missing cache eviction policy in its internal query result storage, leading to unbounded heap growth and potential OOM crashes in long-running processes.

browserslist denial-of-service memory-exhaustion javascript nodejs vulnerability prototype-pollution supply-chain
1t 1c