Every CVE Search/ Get API key

CVE-2021-23364

Regular Expression Denial of Service (ReDoS)

5.3 MediumFix available

The package browserslist from 4.0.0 and before 4.16.5 are vulnerable to Regular Expression Denial of Service (ReDoS) during parsing of queries.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

2.38%Up 0.7 points since Apr 29, 2021
90%50%10%1%

What each source reports

CVE List Score used 5.3

Regular Expression Denial of Service (ReDoS)

The package browserslist from 4.0.0 and before 4.16.5 are vulnerable to Regular Expression Denial of Service (ReDoS) during parsing of queries.

Record
CVE-2021-23364
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P
Updated
2026-11-02
EUVDEUVD-2021-1216 5.3

The package browserslist from 4.0.0 and before 4.16.5 are vulnerable to Regular Expression Denial of Service (ReDoS) during parsing of queries.

Record
EUVD-2021-1216
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P
Updated
2026-11-03
GitHub AdvisoriesGHSA-w8qv-6jwh-64r5 5.3

Regular Expression Denial of Service in browserslist

The package browserslist from 4.0.0 and before 4.16.5 are vulnerable to Regular Expression Denial of Service (ReDoS) during parsing of queries.

Record
GHSA-w8qv-6jwh-64r5
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-400, CWE-1333
Updated
2026-11-02
NVD 5.3

The package browserslist from 4.0.0 and before 4.16.5 are vulnerable to Regular Expression Denial of Service (ReDoS) during parsing of queries.

Record
CVE-2021-23364
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness
CWE-1333
Updated
2026-11-02
OSV 5.3

The package browserslist from 4.0.0 and before 4.16.5 are vulnerable to Regular Expression Denial of Service (ReDoS) during parsing of queries.

Record
CVE-2021-23364
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVDEBIAN-CVE-2021-23364 5.3

The package browserslist from 4.0.0 and before 4.16.5 are vulnerable to Regular Expression Denial of Service (ReDoS) during parsing of queries.

Record
DEBIAN-CVE-2021-23364
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
Show 6 moreShow less
OSVGHSA-w8qv-6jwh-64r5 5.3

Regular Expression Denial of Service in browserslist

The package browserslist from 4.0.0 and before 4.16.5 are vulnerable to Regular Expression Denial of Service (ReDoS) during parsing of queries.

Record
GHSA-w8qv-6jwh-64r5
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-1333, CWE-400
Updated
2026-11-02
OSVUBUNTU-CVE-2021-23364 5.3

The package browserslist from 4.0.0 and before 4.16.5 are vulnerable to Regular Expression Denial of Service (ReDoS) during parsing of queries.

Record
UBUNTU-CVE-2021-23364
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVCLSA-2026-1774311645 No score

TuxCare security update for browserslist (1 CVE)

TuxCare rebuilt browserslist to address 1 CVE. Fixed in 4.13.0-tuxcare.1.

Record
CLSA-2026-1774311645
Updated
2026-11-02
OSVCLSA-2026-1777163887 No score

TuxCare security update for browserslist (1 CVE)

TuxCare rebuilt browserslist to address 1 CVE. Fixed in 4.10.0-tuxcare.2.

Record
CLSA-2026-1777163887
Updated
2026-11-02
OSVCLSA-2026-1788560456 No score

TuxCare security update for browserslist (1 CVE)

TuxCare rebuilt browserslist to address 1 CVE. Fixed in 4.14.2-tuxcare.1.

Record
CLSA-2026-1788560456
Updated
2026-11-02
OSVROOT-APP-NPM-CVE-2021-23364 No score

CVE-2021-23364 in browserslist - Patched by Root

Root has patched CVE-2021-23364 in the browserslist package for Root:npm. Multiple fixed versions available.

Record
ROOT-APP-NPM-CVE-2021-23364
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
browserslist
npm
 4.0.0 up to 4.16.5
4.16.5
browserslist
TuxCare:npm
 4.13.0-tuxcare.0 up to 4.13.0-tuxcare.1, plus listed versions
4.13.0
4.13.0-tuxcare.1
browserslist
TuxCare:npm
 4.10.0-tuxcare.0 up to 4.10.0-tuxcare.2, plus listed versions
4.10.04.10.0-tuxcare.1
4.10.0-tuxcare.2
browserslist
TuxCare:npm
 4.14.2-tuxcare.0 up to 4.14.2-tuxcare.1, plus listed versions
4.14.2
4.14.2-tuxcare.1
node-browserslist
Debian:12
 before 4.16.3+~cs5.4.72-2
4.16.3+~cs5.4.72-2
node-browserslist
Debian:13
 before 4.16.3+~cs5.4.72-2
4.16.3+~cs5.4.72-2
node-browserslist
Debian:14
 before 4.16.3+~cs5.4.72-2
4.16.3+~cs5.4.72-2
browserslist
Root:npm
 before 4.14.2-aikido.2
4.14.2-aikido.24.14.2-aikido.14.15.0-aikido.1
@rootio/browserslist
Root:npm
 before 4.14.2-root.io.2
4.14.2-root.io.24.14.2-root.io.14.15.0-root.io.1
node-browserslist
Ubuntu:18.04:LTS
 All versions, plus listed versions
2.11.3-12.11.3-1build32.11.3-1build4
 None known
node-browserslist
Ubuntu:20.04:LTS
 All versions, plus listed versions
2.11.3-1build4
 None known
node-browserslist
Ubuntu:22.04:LTS
 All versions, plus listed versions
4.16.3+~cs5.4.72-34.17.0+~cs5.6.76-14.18.1+~cs5.1.2-14.19.1+~cs5.1.2-14.19.1+repack+~cs5.1.2-24.19.3+~cs5.1.3-1
 None known

History

History
RecordedChangedSources
aliases, publishedEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-23364 is a medium vulnerability (CVSS 5.3) in Browserslist Project Browserslist, published April 28, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.38%, the 84th percentile. Fixed in browserslist 4.16.5.

References

Show 4 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open