CVE-2026-73089

Description

Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, index.js retains every distinct `(queries, context)` result in cache and every parseQueries() AST in parseCache without a size cap, TTL, or eviction, allowing an attacker who can influence repeated browserslist() query values, including valid since `<year>-<month>-<day>` queries, to bypass the caller-controlled BROWSERSLIST_DISABLE_CACHE mitigation and cause linear memory growth followed by an out-of-memory process crash. This issue is fixed in version 4.28.7.

CVSS Metrics

• v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Trends

Current EPSS score: 0.47%• Percentile: 40%

Techniques & Countermeasures

• CWE-770•Allocation of Resources Without Limits or Throttling

  The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Affected Systems

• chainguard•airflow-2

  all

• chainguard•airflow-core-2

  all

• chainguard•arangodb-3.11

  < 3.11.14.5-r15

• chainguard•arangodb-3.12

  < 3.12.9.4-r28

• chainguard•argo-workflows-ui-4.0

  < 4.0.11-r0

• chainguard•authentik-2025.12

  < 2025.12.6-r13

• chainguard•authentik-2026.5

  < 2026.5.6-r16

• chainguard•authentik-fips-2025.12

  all

• chainguard•authentik-fips-2026.5

  < 2026.5.6-r15

• chainguard•commercial-gitlab-rails-ee-19.1

  all

• chainguard•commercial-gitlab-rails-ee-19.2

  all

• chainguard•commercial-gitlab-rails-ee-19.3

  all

• chainguard•commercial-gitlab-rails-ee-fips-19.1

  all

• chainguard•commercial-gitlab-rails-ee-fips-19.3

  all

• chainguard•gitlab-rails-ce-18.10

  all

• chainguard•gitlab-rails-ce-18.11

  all

• chainguard•gitlab-rails-ce-18.7

  all

• chainguard•gitlab-rails-ce-18.8

  all

• chainguard•gitlab-rails-ce-18.9

  all

• chainguard•gitlab-rails-ce-19.0

  all

• chainguard•gitlab-rails-ce-19.1

  all | < 19.1.7-r6

• chainguard•gitlab-rails-ce-19.3

  < 19.3.1-r6

• chainguard•gitlab-rails-ce-fips-18.10

  all

• chainguard•gitlab-rails-ce-fips-18.11

  all

• chainguard•gitlab-rails-ce-fips-18.7

  all

• chainguard•gitlab-rails-ce-fips-18.8

  all

• chainguard•gitlab-rails-ce-fips-18.9

  all

• chainguard•gitlab-rails-ce-fips-19.0

  all

• chainguard•gitlab-rails-ce-fips-19.1

  all | < 19.1.7-r7

• chainguard•jupyter-base-notebook

  all

• chainguard•katib-suggestion-hyperopt

  < 0.19.0-r40

• chainguard•langfuse-3-compat

  < 3.225.7-r6

• chainguard•langfuse-3-worker

  all | < 3.225.7-r4

• chainguard•langfuse-4-worker

  < 4.27.0-r2

• chainguard•langfuse-fips-3-worker

  < 3.225.5-r1

• chainguard•langfuse-fips-4-worker

  < 4.26.0-r2

• chainguard•nextcloud-server-32

  < 32.0.14-r2

• chainguard•nextcloud-server-34

  < 34.0.3-r4

• chainguard•tensorflow-gpu-jupyter

  all | < 2.21.0-r9

• chainguard•ts-patch

  < 4.0.1-r44

• chainguard•vitess-22

  < 22.0.4-r22

• chainguard•vitess-23

  < 23.0.6-r3

• chainguard•vitess-24

  < 24.0.3-r1

• chainguard•vitess-24-compat

  < 24.0.3-r7

• chainguard•wazuh-dashboard-dashboards-reporting

  < 4.14.7-r13

• chainguard•wazuh-dashboard-dashboards-reporting-fips

  < 4.14.7-r14

• wolfi•argo-workflows-ui-4.0

  < 4.0.11-r0

• wolfi•jupyter-base-notebook

  all

• wolfi•katib-suggestion-hyperopt

  < 0.19.0-r40

• wolfi•langfuse-3-compat

  < 3.225.7-r6

Showing first 50 affected entries in server-rendered view.

References (9)

• https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx
• https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405
• https://github.com/browserslist/browserslist/releases/tag/4.28.7
• https://security-tracker.debian.org/tracker/CVE-2026-73089
• https://ubuntu.com/security/CVE-2026-73089
• https://www.cve.org/CVERecord?id=CVE-2026-73089
• https://nvd.nist.gov/vuln/detail/CVE-2026-73089
• https://github.com/browserslist/browserslist
• https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73089.json