node-browserslist: Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools
CVE-2026-73089 is fixed in 2 products on 1 platform, first by DEBIAN-CVE-2026-73089, released August 13, 2026. It is not reported as exploited. Patch Radar priority: High.
Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, index.js retains every distinct `(queries, context)` result in cache and every parseQueries() AST in parseCache without a size cap, TTL, or eviction, allowing an attacker who can influence repeated browserslist() query values, including valid since `<year>-<month>-<day>` queries, to bypass the caller-controlled BROWSERSLIST_DISABLE_CACHE mitigation and cause linear memory growth followed by an out-of-memory process crash. This issue is fixed in version 4.28.7.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| node-browserslist · Debian 14 | 4.28.7+~cs8.16.65-1 | DEBIAN-CVE-2026-73089 | Aug 13, 2026 |
| python-pytest-html · opensuse-leap 16.0 | 4.1.1-bp160.5.1 | OPENSUSE-SU-2026:21602-1 | Aug 18, 2026 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.