6.6

CVE-2026-45819: web-platform-dx baseline-browser-mapping Incorrect Control Flow Scoping

Deferred
AliasesCGA-63m2-hh8h-vx6pCGA-66w9-xwj6-4g7mCGA-8964-6rp9-2w39
Published 13-08-2026Last modified 13-08-2026

Vulnerability summary

CVE-2026-45819 is a medium (CVSS 6.6) Incorrect Control Flow Scoping vulnerability in web-platform-dx baseline-browser-mapping. EPSS estimates a 0.51% chance of exploitation in the next 30 days, higher than 43.3% of scored vulnerabilities.

Priority
Routine

Not severe (CVSS 6.6, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
6.6/10
010
Medium · v4.0 (CVE.org)
EPSS score
0.51%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 2
RHSA-2026:54517RHSA-2026:54518

Timeline

  1. 13-08-2026
    PublishedVulnerability first disclosed.
  2. 13-08-2026
    Last modifiedVulnerability information updated.

Description

baseline-browser-mapping 2.x before 2.11.0 calls process.exit() instead of throwing on invalid or conflicting input parameters, and can trigger immediate process termination, causing denial of service.

CVSS metrics

5 scores · 5 sources · 1 version

EPSS trend

Probability

0.51%

Chance of exploitation in the next 30 days

Percentile

43%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.51% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard19 products
  • airflow-2All versions (No fix recorded)
  • airflow-core-2All versions (No fix recorded)
  • argo-workflows-ui-4.0< 4.0.11-r0
  • authentik-fips-2025.12All versions (No fix recorded)
  • commercial-gitlab-rails-ee-19.1< 19.1.7-r3
Wolfi4 products
  • argo-workflows-ui-4.0< 4.0.11-r0
  • jupyter-base-notebook< 7.6.3-r2
  • langfuse-3-compat< 3.225.7-r6
  • langfuse-3-worker< 3.225.7-r4
Npm1 product
  • baseline-browser-mapping≥ 2.0.0, < 2.11.0
Web-platform-dx1 product

4 vendors · 25 products

References

9 links