{"id":"CVE-2026-45819","aliases":["CLSA-2026-1791198699","CLSA-2026-1791282757","CLSA-2026-1792163954","EUVD-2026-57788","GHSA-w5vr-8v7q-w6rv","RHSA-2026:54517","RHSA-2026:54518"],"status":"published","title":"baseline-browser-mapping process termination on invalid input causes denial of service","description":"baseline-browser-mapping 2.x before 2.11.0 calls process.exit() instead of throwing on invalid or conflicting input parameters, and can trigger immediate process termination, causing denial of service.","severity":{"version":"4.0","score":6.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/S:N/AU:Y/R:U/V:D/RE:M/U:Amber","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00507,"percentile":0.43536,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-705","CWE-755"],"published":"2026-08-13T10:17:50Z","modified":"2026-10-28T02:30:36Z","fixes":[{"ecosystem":"npm","package":"baseline-browser-mapping","fixed_in":["2.11.0"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"baseline-browser-mapping","fixed_in":["2.10.0-tuxcare.2","2.10.38-tuxcare.1","2.10.34-tuxcare.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"baseline-browser-mapping","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.11.0"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"baseline-browser-mapping","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.10.0-tuxcare.0"},{"fixed":"2.10.0-tuxcare.2"}]}],"versions":["2.10.0","2.10.0-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"baseline-browser-mapping","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.10.38-tuxcare.0"},{"fixed":"2.10.38-tuxcare.1"}]}],"versions":["2.10.38"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"baseline-browser-mapping","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.10.34-tuxcare.0"},{"fixed":"2.10.34-tuxcare.1"}]}],"versions":["2.10.34"]},{"source":"osv","ecosystem":"npm","package":"baseline-browser-mapping","ranges":[{"type":"SEMVER","events":[{"introduced":"2.0.0"},{"fixed":"2.11.0"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"grafana13.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:13.1.3-0.1.1.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"grafana12.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.4.8-0.1.1.hum1"}]}],"bundled":5}],"products":[{"vendor":"web-platform-dx","product":"baseline-browser-mapping"}],"references":[{"url":"https://github.com/web-platform-dx/baseline-browser-mapping/blob/b7881aa61c8a057e24468ab5ee18c5ecedbbf691/src/index.ts#L142","tags":["web","article"]},{"url":"https://www.npmjs.com/package/baseline-browser-mapping","tags":["web","article"]},{"url":"https://github.com/web-platform-dx/baseline-browser-mapping/pull/137/changes#diff-7ae45ad102eab3b6d7e7896acd08c427a9b25b346470d7bc6507b6481575d519","tags":["patch","fix","web","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45819","tags":["advisory"]},{"url":"https://github.com/web-platform-dx/baseline-browser-mapping/pull/137","tags":["web"]},{"url":"https://github.com/web-platform-dx/baseline-browser-mapping/commit/de733e2d8959559f7bb255d5927f3afcb6f31589","tags":["web"]},{"url":"https://github.com/web-platform-dx/baseline-browser-mapping/releases/tag/v2.11.0","tags":["web"]},{"url":"https://github.com/advisories/GHSA-w5vr-8v7q-w6rv"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45819.json","tags":["advisory"]},{"url":"https://github.com/web-platform-dx/baseline-browser-mapping","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2026:54517","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-73088","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-73089","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-45819","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-16221","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-65904","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-65912","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-65911","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-65914","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-65913","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54517.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2502307","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-16221","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16221","tags":["advisory"]},{"url":"https://cna.openjsf.org/security-advisories.html","tags":["article"]},{"url":"https://github.com/fastify/fast-uri/security/advisories/GHSA-v2hh-gcrm-f6hx","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515240","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-45819","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506426","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-65904","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65904","tags":["advisory"]},{"url":"https://github.com/cure53/DOMPurify/security/advisories/GHSA-4w3q-35jp-p934","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/dompurify-before-cross-site-scripting-via-in-place-mode","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506434","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-65911","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65911","tags":["advisory"]},{"url":"https://github.com/cure53/DOMPurify/security/advisories/GHSA-9p3w-6h5p-cv75","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/dompurify-before-xss-via-add-attr-add-tags-state-leakage","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506427","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-65912","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65912","tags":["advisory"]},{"url":"https://github.com/cure53/DOMPurify/security/advisories/GHSA-cjmm-f4jc-qw8r","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/dompurify-before-uri-validation-bypass-via-add-attr","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506429","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-65913","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65913","tags":["advisory"]},{"url":"https://github.com/cure53/DOMPurify/security/advisories/GHSA-cj63-jhhr-wcxv","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/dompurify-before-prototype-pollution-via-use-profiles","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506430","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-65914","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65914","tags":["advisory"]},{"url":"https://github.com/cure53/DOMPurify/security/advisories/GHSA-h8r8-wccr-v5f2","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/dompurify-before-mutation-xss-via-re-contextualization","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2514177","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-73088","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73088","tags":["advisory"]},{"url":"https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51","tags":["article"]},{"url":"https://github.com/browserslist/browserslist/releases/tag/4.28.7","tags":["article"]},{"url":"https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2514195","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-73089","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73089","tags":["advisory"]},{"url":"https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405","tags":["article"]},{"url":"https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:54518","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-73086","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54518.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2514175","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-73086","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73086","tags":["advisory"]},{"url":"https://github.com/ai/nanoid/commit/7087969281cab8ba8ae3babf1894e819068b3bb4","tags":["article"]},{"url":"https://github.com/ai/nanoid/commit/821dfed7b5db7f88e92f56c60eef32c8135077c3","tags":["article"]},{"url":"https://github.com/ai/nanoid/commit/b0036ed60dc9facd7f1191a50dfb3076500202ac","tags":["article"]},{"url":"https://github.com/ai/nanoid/releases/tag/3.3.12","tags":["article"]},{"url":"https://github.com/ai/nanoid/releases/tag/5.1.11","tags":["article"]},{"url":"https://github.com/ai/nanoid/security/advisories/GHSA-xwg4-73v4-xw9w","tags":["article"]}],"sources":{"cve":[{"id":"CVE-2026-45819","description":"baseline-browser-mapping 2.x before 2.11.0 calls process.exit() instead of throwing on invalid or conflicting input parameters, and can trigger immediate process termination, causing denial of service.","status":"published","published":"2026-08-13T11:03:42.504Z","modified":"2026-08-13T14:46:30.611Z","cvss":[{"version":"4.0","score":6.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/S:N/AU:Y/R:U/V:D/RE:M/U:Amber","level":"medium","assessor":"cna"}],"cwes":["CWE-705","CWE-755"],"updated_at":"2026-11-02T13:46:43.922571Z"}],"euvd":[{"id":"EUVD-2026-57788","description":"baseline-browser-mapping 2.x before 2.11.0 calls process.exit() instead of throwing on invalid or conflicting input parameters, and can trigger immediate process termination, causing denial of service.","status":"published","published":"2026-08-13T11:03:42Z","modified":"2026-08-13T14:46:30Z","cvss":[{"version":"4.0","score":6.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/S:N/AU:Y/R:U/V:D/RE:M/U:Amber","level":"medium"}],"updated_at":"2026-11-02T18:01:56.415282Z"}],"ghsa":[{"id":"GHSA-w5vr-8v7q-w6rv","title":"baseline-browser-mapping process termination on invalid input causes denial of service","description":"baseline-browser-mapping 2.x before 2.11.0 calls process.exit() instead of throwing on invalid or conflicting input parameters, and can trigger immediate process termination, causing denial of service.","status":"published","published":"2026-08-13T12:31:09Z","modified":"2026-09-08T20:41:23Z","cvss":[{"version":"4.0","score":6.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/S:N/AU:Y/R:U/V:D/RE:M/U:Amber","level":"medium"}],"cwes":["CWE-705"],"updated_at":"2026-11-02T14:41:14.764963Z"}],"nvd":[{"id":"CVE-2026-45819","description":"baseline-browser-mapping 2.x before 2.11.0 calls process.exit() instead of throwing on invalid or conflicting input parameters, and can trigger immediate process termination, causing denial of service.","status":"published","published":"2026-08-13T12:17:23.383Z","modified":"2026-10-23T19:10:00.167Z","cvss":[{"version":"4.0","score":6.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:M/U:Amber","level":"medium","assessor":"secondary"}],"cwes":["CWE-705","CWE-755"],"updated_at":"2026-11-02T14:12:37.217486Z"}],"osv":[{"id":"CVE-2026-45819","description":"baseline-browser-mapping 2.x before 2.11.0 calls process.exit() instead of throwing on invalid or conflicting input parameters, and can trigger immediate process termination, causing denial of service.","status":"published","published":"2026-08-13T11:03:42.504Z","modified":"2026-10-28T02:30:36.751457867Z","cvss":[{"version":"4.0","score":6.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/S:N/AU:Y/R:U/V:D/RE:M/U:Amber","level":"medium"}],"cwes":["CWE-705","CWE-755"],"updated_at":"2026-11-02T15:45:05.525666Z"},{"id":"GHSA-w5vr-8v7q-w6rv","title":"baseline-browser-mapping process termination on invalid input causes denial of service","description":"baseline-browser-mapping 2.x before 2.11.0 calls process.exit() instead of throwing on invalid or conflicting input parameters, and can trigger immediate process termination, causing denial of service.","status":"published","published":"2026-08-13T12:31:09Z","modified":"2026-09-08T21:10:57.707771Z","cvss":[{"version":"4.0","score":6.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/S:N/AU:Y/R:U/V:D/RE:M/U:Amber","level":"medium"}],"cwes":["CWE-705"],"updated_at":"2026-11-02T15:46:58.04805Z"},{"id":"RHSA-2026:54517","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-08-13T10:17:50Z","modified":"2026-10-20T10:11:09Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:54518","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-08-14T10:16:47Z","modified":"2026-10-20T10:11:09Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"CLSA-2026-1791198699","title":"TuxCare security update for baseline-browser-mapping (1 CVE)","description":"TuxCare rebuilt baseline-browser-mapping to address 1 CVE. Fixed in 2.10.0-tuxcare.2.","status":"published","published":"2026-10-05T11:11:39Z","modified":"2026-10-15T09:47:39.256309294Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791282757","title":"TuxCare security update for baseline-browser-mapping (1 CVE)","description":"TuxCare rebuilt baseline-browser-mapping to address 1 CVE. Fixed in 2.10.38-tuxcare.1.","status":"published","published":"2026-10-06T10:32:37Z","modified":"2026-10-15T09:47:35.503164124Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1792163954","title":"TuxCare security update for baseline-browser-mapping (1 CVE)","description":"TuxCare rebuilt baseline-browser-mapping to address 1 CVE. Fixed in 2.10.34-tuxcare.1.","status":"published","published":"2026-10-16T15:19:14Z","modified":"2026-10-16T16:31:58.909574106Z","updated_at":"2026-11-02T15:43:51.747192Z"}]}}