npmPackage

browserslist

3 known vulnerabilities (2 high, 1 medium), with the versions each affects and the releases that fix them.

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

CVE-2026-73089High 7.5
Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM
Affected: fixed in 4.28.7.
Fixed in 4.28.7 (released Jul 21, 2026, 21 days before disclosure).
The latest release, 4.29.5, is not affected.
45% of browserslist downloads last week were affected versions (130.6M).
CVE-2026-73088High 7.5
Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)
Affected: fixed in 4.28.7.
Fixed in 4.28.7 (released Jul 21, 2026, 21 days before disclosure).
The latest release, 4.29.5, is not affected.
45% of browserslist downloads last week were affected versions (130.6M).
CVE-2021-23364Medium 5.3
Regular Expression Denial of Service (ReDoS)
Affected: from 4.0.0, fixed in 4.16.5.
Fixed in 4.16.5 (released Apr 22, 2021, 6 days before disclosure).
The latest release, 4.29.5, is not affected.
1.1% of browserslist downloads last week were affected versions (3.3M).