{"id":"CVE-2026-73089","aliases":["CLSA-2026-1790175511","CLSA-2026-1790175574","CLSA-2026-1790175577","CLSA-2026-1790177674","CLSA-2026-1790950178","CLSA-2026-1790965158","CLSA-2026-1791199397","CLSA-2026-1791199466","CLSA-2026-1792443101","CLSA-2026-1792477554","CLSA-2026-1792495777","CLSA-2026-1792508656","CLSA-2026-1793111870","CLSA-2026-1793180856","CLSA-2026-1793183890","CLSA-2026-1793187937","CLSA-2026-1793207044","CLSA-2026-1793209361","CLSA-2026-1794048476","DEBIAN-CVE-2026-73089","EUVD-2026-56600","GHSA-c83g-rgw3-j3cx","RHSA-2026:54517","RHSA-2026:54518","ROOT-APP-NPM-CVE-2026-73089","UBUNTU-CVE-2026-73089","openSUSE-SU-2026:11680-1","openSUSE-SU-2026:21602-1"],"status":"published","title":"Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM","description":"Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, index.js retains every distinct `(queries, context)` result in cache and every parseQueries() AST in parseCache without a size cap, TTL, or eviction, allowing an attacker who can influence repeated browserslist() query values, including valid since `\u003cyear\u003e-\u003cmonth\u003e-\u003cday\u003e` queries, to bypass the caller-controlled BROWSERSLIST_DISABLE_CACHE mitigation and cause linear memory growth followed by an out-of-memory process crash. This issue is fixed in version 4.28.7.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00655,"percentile":0.51722,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-770"],"published":"2026-08-11T17:05:38Z","modified":"2026-11-07T13:15:02Z","fixes":[{"ecosystem":"npm","package":"browserslist","fixed_in":["4.28.7"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"browserslist","fixed_in":["4.10.0-tuxcare.5","4.14.2-tuxcare.3","3.2.8-tuxcare.2","2.11.3-tuxcare.3","4.24.4-tuxcare.2","4.28.1-tuxcare.2","4.24.0-tuxcare.2","4.23.2-tuxcare.1","4.23.1-tuxcare.1","4.23.0-tuxcare.1","4.21.10-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-browserslist","fixed_in":["4.28.7+~cs8.16.65-1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"browserslist","fixed_in":["4.20.3-aikido.1","4.28.4-aikido.1","4.28.1-aikido.1","4.12.0-aikido.1","4.14.2-aikido.2","4.20.2-aikido.1","4.22.2-aikido.1","4.25.1-aikido.1","4.28.2-aikido.1","4.23.0-aikido.1","4.21.2-aikido.1","4.21.5-aikido.1","3.2.8-aikido.1","4.24.2-aikido.1","4.24.0-aikido.1","4.7.0-aikido.1","4.17.1-aikido.1","4.21.4-aikido.1","1.7.7-aikido.2"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/browserslist","fixed_in":["4.20.3-root.io.1","4.28.4-root.io.1","4.28.1-root.io.1","4.12.0-root.io.1","4.14.2-root.io.2","4.20.2-root.io.1","4.22.2-root.io.1","4.25.1-root.io.1","4.28.2-root.io.1","4.23.0-root.io.1","4.21.2-root.io.1","4.21.5-root.io.1","3.2.8-root.io.1","4.24.2-root.io.1","4.24.0-root.io.1","4.7.0-root.io.1","4.17.1-root.io.1","4.21.4-root.io.1","1.7.7-root.io.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"browserslist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"4.28.6"},{"fixed":"4.28.7"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"browserslist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.10.0-tuxcare.0"},{"fixed":"4.10.0-tuxcare.5"}]}],"versions":["4.10.0","4.10.0-tuxcare.1","4.10.0-tuxcare.2","4.10.0-tuxcare.3","4.10.0-tuxcare.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"browserslist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.14.2-tuxcare.0"},{"fixed":"4.14.2-tuxcare.3"}]}],"versions":["4.14.2","4.14.2-tuxcare.1","4.14.2-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"browserslist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.27.0-tuxcare.0"},{"fixed":"4.27.0-tuxcare.2"}]}],"versions":["4.27.0","4.27.0-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"browserslist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.13.0-tuxcare.0"},{"fixed":"4.13.0-tuxcare.3"}]}],"versions":["4.13.0","4.13.0-tuxcare.1","4.13.0-tuxcare.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"browserslist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.8-tuxcare.0"},{"fixed":"3.2.8-tuxcare.2"}]}],"versions":["3.2.8","3.2.8-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"browserslist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.11.3-tuxcare.0"},{"fixed":"2.11.3-tuxcare.3"}]}],"versions":["2.11.3","2.11.3-tuxcare.1","2.11.3-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"browserslist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.24.4-tuxcare.0"},{"fixed":"4.24.4-tuxcare.2"}]}],"versions":["4.24.4","4.24.4-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"browserslist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.21.5-tuxcare.0"},{"fixed":"4.21.5-tuxcare.1"}]}],"versions":["4.21.5"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"browserslist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.28.5-tuxcare.0"},{"fixed":"4.28.5-tuxcare.1"}]}],"versions":["4.28.5"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"browserslist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.28.4-tuxcare.0"},{"fixed":"4.28.4-tuxcare.1"}]}],"versions":["4.28.4"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"browserslist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.28.2-tuxcare.0"},{"fixed":"4.28.2-tuxcare.1"}]}],"versions":["4.28.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"browserslist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.28.1-tuxcare.0"},{"fixed":"4.28.1-tuxcare.2"}]}],"versions":["4.28.1","4.28.1-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"browserslist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.24.0-tuxcare.0"},{"fixed":"4.24.0-tuxcare.2"}]}],"versions":["4.24.0","4.24.0-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"browserslist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.23.3-tuxcare.0"},{"fixed":"4.23.3-tuxcare.1"}]}],"versions":["4.23.3"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"browserslist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.23.2-tuxcare.0"},{"fixed":"4.23.2-tuxcare.1"}]}],"versions":["4.23.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"browserslist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.23.1-tuxcare.0"},{"fixed":"4.23.1-tuxcare.1"}]}],"versions":["4.23.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"browserslist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.23.0-tuxcare.0"},{"fixed":"4.23.0-tuxcare.1"}]}],"versions":["4.23.0"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"browserslist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.21.10-tuxcare.0"},{"fixed":"4.21.10-tuxcare.1"}]}],"versions":["4.21.10"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"browserslist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.18.1-tuxcare.0"},{"fixed":"4.18.1-tuxcare.1"}]}],"versions":["4.18.1"],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"node-browserslist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.21.10+~cs6.1.25-1","4.21.10+~cs6.1.25-2","4.21.4+~cs6.1.17-2","4.22.1+~cs6.1.27-1","4.22.1+~cs6.1.28-1","4.23.0+~cs6.1.32-1","4.24.4+~cs6.3.21-1","4.24.4+~cs6.3.22-1","4.25.0+~cs6.3.22-1","4.25.2+~cs6.3.22-1","4.26.0+~cs8.11.27-1","4.27.0+~cs8.11.53-1","4.27.0+~cs8.11.53-2","4.28.1+~cs8.14.48-1","4.28.2+~cs8.14.68-1","4.28.7+~cs8.16.65-1"]},{"source":"osv","ecosystem":"Debian:13","package":"node-browserslist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.25.0+~cs6.3.22-1","4.25.2+~cs6.3.22-1","4.26.0+~cs8.11.27-1","4.27.0+~cs8.11.53-1","4.27.0+~cs8.11.53-2","4.28.1+~cs8.14.48-1","4.28.2+~cs8.14.68-1","4.28.7+~cs8.16.65-1"]},{"source":"osv","ecosystem":"Debian:14","package":"node-browserslist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.28.7+~cs8.16.65-1"}]}],"versions":["4.25.0+~cs6.3.22-1","4.25.2+~cs6.3.22-1","4.26.0+~cs8.11.27-1","4.27.0+~cs8.11.53-1","4.27.0+~cs8.11.53-2","4.28.1+~cs8.14.48-1","4.28.2+~cs8.14.68-1"]},{"source":"osv","ecosystem":"npm","package":"browserslist","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.28.7"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"grafana13.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:13.1.3-0.1.1.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"grafana12.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.4.8-0.1.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Root:npm","package":"browserslist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.20.3-aikido.1"},{"fixed":"4.28.4-aikido.1"},{"fixed":"4.28.1-aikido.1"},{"fixed":"4.12.0-aikido.1"},{"fixed":"4.14.2-aikido.2"},{"fixed":"4.20.2-aikido.1"},{"fixed":"4.22.2-aikido.1"},{"fixed":"4.25.1-aikido.1"},{"fixed":"4.28.2-aikido.1"},{"fixed":"4.23.0-aikido.1"},{"fixed":"4.21.2-aikido.1"},{"fixed":"4.21.5-aikido.1"},{"fixed":"3.2.8-aikido.1"},{"fixed":"4.24.2-aikido.1"},{"fixed":"4.24.0-aikido.1"},{"fixed":"4.7.0-aikido.1"},{"fixed":"4.17.1-aikido.1"},{"fixed":"4.21.4-aikido.1"},{"fixed":"1.7.7-aikido.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/browserslist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.20.3-root.io.1"},{"fixed":"4.28.4-root.io.1"},{"fixed":"4.28.1-root.io.1"},{"fixed":"4.12.0-root.io.1"},{"fixed":"4.14.2-root.io.2"},{"fixed":"4.20.2-root.io.1"},{"fixed":"4.22.2-root.io.1"},{"fixed":"4.25.1-root.io.1"},{"fixed":"4.28.2-root.io.1"},{"fixed":"4.23.0-root.io.1"},{"fixed":"4.21.2-root.io.1"},{"fixed":"4.21.5-root.io.1"},{"fixed":"3.2.8-root.io.1"},{"fixed":"4.24.2-root.io.1"},{"fixed":"4.24.0-root.io.1"},{"fixed":"4.7.0-root.io.1"},{"fixed":"4.17.1-root.io.1"},{"fixed":"4.21.4-root.io.1"},{"fixed":"1.7.7-root.io.2"}]}]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"node-browserslist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.11.3-1","2.11.3-1build3","2.11.3-1build4"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"node-browserslist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.11.3-1build4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-browserslist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.16.3+~cs5.4.72-3","4.17.0+~cs5.6.76-1","4.18.1+~cs5.1.2-1","4.19.1+~cs5.1.2-1","4.19.1+repack+~cs5.1.2-2","4.19.3+~cs5.1.3-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-browserslist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.21.4+~cs6.1.17-2","4.22.1+~cs6.1.28-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-browserslist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.25.2+~cs6.3.22-1","4.26.0+~cs8.11.27-1","4.27.0+~cs8.11.53-2","4.28.1+~cs8.14.48-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"agama-web-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24+0.a836cced5-52.1"}]}],"bundled":19},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"python-pytest-html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.1-bp160.5.1"}]}],"bundled":2}],"products":[{"vendor":"browserslist","product":"browserslist"}],"references":[{"url":"https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx","tags":["x_refsource_CONFIRM","advisory","web","article","report"]},{"url":"https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405","tags":["x_refsource_MISC","fix","web","article","report"]},{"url":"https://github.com/browserslist/browserslist/releases/tag/4.28.7","tags":["x_refsource_MISC","web","article","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73089","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-c83g-rgw3-j3cx"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73089.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-73089","tags":["advisory"]},{"url":"https://github.com/browserslist/browserslist","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2026:54517","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-73088","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-73089","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-45819","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-16221","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-65904","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-65912","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-65911","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-65914","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-65913","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54517.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2502307","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-16221","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16221","tags":["advisory"]},{"url":"https://cna.openjsf.org/security-advisories.html","tags":["article"]},{"url":"https://github.com/fastify/fast-uri/security/advisories/GHSA-v2hh-gcrm-f6hx","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515240","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-45819","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45819","tags":["advisory"]},{"url":"https://github.com/web-platform-dx/baseline-browser-mapping/blob/b7881aa61c8a057e24468ab5ee18c5ecedbbf691/src/index.ts#L142","tags":["article"]},{"url":"https://github.com/web-platform-dx/baseline-browser-mapping/pull/137/changes#diff-7ae45ad102eab3b6d7e7896acd08c427a9b25b346470d7bc6507b6481575d519","tags":["article"]},{"url":"https://www.npmjs.com/package/baseline-browser-mapping","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506426","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-65904","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65904","tags":["advisory"]},{"url":"https://github.com/cure53/DOMPurify/security/advisories/GHSA-4w3q-35jp-p934","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/dompurify-before-cross-site-scripting-via-in-place-mode","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506434","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-65911","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65911","tags":["advisory"]},{"url":"https://github.com/cure53/DOMPurify/security/advisories/GHSA-9p3w-6h5p-cv75","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/dompurify-before-xss-via-add-attr-add-tags-state-leakage","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506427","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-65912","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65912","tags":["advisory"]},{"url":"https://github.com/cure53/DOMPurify/security/advisories/GHSA-cjmm-f4jc-qw8r","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/dompurify-before-uri-validation-bypass-via-add-attr","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506429","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-65913","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65913","tags":["advisory"]},{"url":"https://github.com/cure53/DOMPurify/security/advisories/GHSA-cj63-jhhr-wcxv","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/dompurify-before-prototype-pollution-via-use-profiles","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506430","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-65914","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65914","tags":["advisory"]},{"url":"https://github.com/cure53/DOMPurify/security/advisories/GHSA-h8r8-wccr-v5f2","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/dompurify-before-mutation-xss-via-re-contextualization","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2514177","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-73088","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73088","tags":["advisory"]},{"url":"https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51","tags":["article"]},{"url":"https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2514195","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-73089","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2026:54518","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-73086","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54518.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2514175","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-73086","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73086","tags":["advisory"]},{"url":"https://github.com/ai/nanoid/commit/7087969281cab8ba8ae3babf1894e819068b3bb4","tags":["article"]},{"url":"https://github.com/ai/nanoid/commit/821dfed7b5db7f88e92f56c60eef32c8135077c3","tags":["article"]},{"url":"https://github.com/ai/nanoid/commit/b0036ed60dc9facd7f1191a50dfb3076500202ac","tags":["article"]},{"url":"https://github.com/ai/nanoid/releases/tag/3.3.12","tags":["article"]},{"url":"https://github.com/ai/nanoid/releases/tag/5.1.11","tags":["article"]},{"url":"https://github.com/ai/nanoid/security/advisories/GHSA-xwg4-73v4-xw9w","tags":["article"]},{"url":"https://ubuntu.com/security/CVE-2026-73089","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-7783","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-13149","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-13676","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33245","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49356","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53550","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53632","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54466","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55602","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67313","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67315","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67317","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67319","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67321","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-69153","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73086","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73088","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73089","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73650","tags":["web"]},{"url":"https://bugzilla.suse.com/1275374","tags":["report"]},{"url":"https://bugzilla.suse.com/1275437","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-73089","title":"Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM","description":"Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, index.js retains every distinct `(queries, context)` result in cache and every parseQueries() AST in parseCache without a size cap, TTL, or eviction, allowing an attacker who can influence repeated browserslist() query values, including valid since `\u003cyear\u003e-\u003cmonth\u003e-\u003cday\u003e` queries, to bypass the caller-controlled BROWSERSLIST_DISABLE_CACHE mitigation and cause linear memory growth followed by an out-of-memory process crash. This issue is fixed in version 4.28.7.","status":"published","published":"2026-08-11T17:05:38.76Z","modified":"2026-08-13T14:07:57.169Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T13:43:33.766176Z"}],"euvd":[{"id":"EUVD-2026-56600","description":"Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, index.js retains every distinct `(queries, context)` result in cache and every parseQueries() AST in parseCache without a size cap, TTL, or eviction, allowing an attacker who can influence repeated browserslist() query values, including valid since `\u003cyear\u003e-\u003cmonth\u003e-\u003cday\u003e` queries, to bypass the caller-controlled BROWSERSLIST_DISABLE_CACHE mitigation and cause linear memory growth followed by an out-of-memory process crash. This issue is fixed in version 4.28.7.","status":"published","published":"2026-08-11T17:05:38Z","modified":"2026-08-13T14:07:57Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T18:01:56.761721Z"}],"ghsa":[{"id":"GHSA-c83g-rgw3-j3cx","title":"Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM","description":"## Vulnerability Details\n\n**File**: `index.js`\n**Location**: `cache` (browserslist()'s result cache, line ~402) and\n`parseCache` (parseQueries()'s AST cache)\n\n### Root Cause\n```js\nvar cache = {}\nvar parseCache = {}\n\nfunction browserslist(queries, opts) {\n  ...\n  var cacheKey = JSON.stringify([queries, context])\n  if (cache[cacheKey]) return cache[cacheKey]\n  ...\n  if (!env.env.BROWSERSLIST_DISABLE_CACHE) { cache[cacheKey] = result }\n  return result\n}\n\nfunction parseQueries(queries) {\n  var cacheKey = JSON.stringify(queries)\n  if (cacheKey in parseCache) return parseCache[cacheKey]\n  var result = parseWithoutCache(QUERIES, queries)\n  if (!env.env.BROWSERSLIST_DISABLE_CACHE) { parseCache[cacheKey] = result }\n  ...\n}\n```\nEvery distinct `(queries, context)` pair is cached forever — no size cap,\nTTL, or eviction. `browserslist.clearCaches()` never resets either object\n(it only resets `node.js`'s own filesystem caches); the only opt-out is the\n`BROWSERSLIST_DISABLE_CACHE` env var, controlled by the *calling\napplication*, not an attacker.\n\nSome short, valid queries amplify this badly. The `since \u003cyear\u003e-\u003cmonth\u003e-\u003cday\u003e`\nquery type (`/^since (\\d+)-(\\d+)-(\\d+)$/i`) accepts **any** digit\ncombination — `Date.UTC()` normalizes rather than rejects out-of-range\nvalues — giving an effectively unbounded space of ~17-byte distinct cache\nkeys, each of which resolves to (and caches) a result close to the full\n~8.5 KB browser list for any sufficiently old year.\n\n### Measured Impact\n20,000 distinct `since \u003cyear\u003e-\u003cmonth\u003e-\u003cday\u003e` queries (~330 KB total input,\n`--expose-gc` before/after measurement to rule out uncollected garbage)\nretained **over 50 MB** of heap permanently — roughly **150x**\namplification, growing linearly with no cap observed up to 40,000 queries\n(52.3 MB).\n\n### Attack Scenario\nAny long-running process (server, daemon, warm CI worker) that calls\n`browserslist()` with a query value that varies across requests/items and is\ninfluenced, even partially, by external input accumulates one cache entry\nper distinct value ever seen. An attacker who can influence that value\nacross *many* requests (this is a volumetric attack, unlike the\nsingle-request DoS findings from this same research pass) sends a stream of\ncheap, distinct queries (e.g. `since 1900-01-01`, `since 1900-01-02`, ...)\nuntil the process runs out of memory and crashes.\n\n### Recommended Fix (implemented and verified)\nReplace both plain-object caches with `Map`s bounded to a fixed maximum\nentry count, evicting the oldest entry once the cap is reached (`Map`\npreserves insertion order, so `.keys().next().value` is always oldest):\n\n```js\nvar CACHE_MAX_ENTRIES = 500\n\nfunction boundedCacheSet(map, key, value) {\n  if (map.size \u003e= CACHE_MAX_ENTRIES) {\n    map.delete(map.keys().next().value)\n  }\n  map.set(key, value)\n}\n\nvar cache = new Map()\nvar parseCache = new Map()\n```\n(read sites changed to `.has()`/`.get()`, write sites to `boundedCacheSet()`)\n\n**Verification**:\n- `NODE_ENV=test npx uvu test .test.js` → 301/301 pass unmodified\n  (`test/cache.test.js` exercises `clearCaches()`/`BROWSERSLIST_DISABLE_CACHE`\n  against `node.js`'s separate filesystem caches, unaffected here); confirmed\n  a repeated identical call still returns the cached reference.\n- Re-ran the memory PoC post-fix: heap stayed flat at ~4.9 MB after 5,000,\n  10,000, 20,000, and 40,000 distinct `since`-date queries (was\n  10.5 → 16.5 → 28.4 → 52.3 MB pre-fix).\n\n### Impact\n- **Who is affected**: Long-running processes calling `browserslist()` with\n  query values that vary across requests/items and are influenced by\n  external input.\n- **What an attacker achieves**: DoS via eventual out-of-memory crash, given\n  sustained traffic over time (not a single small payload).\n- **Conditions required**: No authentication; requires volume rather than a\n  single request, hence Medium rather than High severity.\n\n### Verification Environment\nbrowserslist @ HEAD (== v4.28.6, current latest stable release) under local\nNode.js v20.19.5, run with `--expose-gc` for accurate heap measurement.\n\n### Note\nFound during a broader review of this codebase in the same research pass\nthat produced GHSA-rrmg-cfrq-23vv (parse.js algorithmic complexity),\nGHSA-g6p8-hj8g-x889 (baseline regexp ReDoS), GHSA-73wf-gq98-2v4g\n(normalizeStats crash/prototype write), and GHSA-h633-868p-5rfw\n(SCOPED_CONFIG__PATTERN ReDoS) — all single-request DoS vectors. This one is\ndifferent in character (volumetric, not single-request) and is reported\nseparately/scored lower accordingly.","status":"published","published":"2026-09-01T16:42:13Z","modified":"2026-09-01T16:42:15Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:41:08.980668Z"}],"nvd":[{"id":"CVE-2026-73089","description":"Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, index.js retains every distinct `(queries, context)` result in cache and every parseQueries() AST in parseCache without a size cap, TTL, or eviction, allowing an attacker who can influence repeated browserslist() query values, including valid since `\u003cyear\u003e-\u003cmonth\u003e-\u003cday\u003e` queries, to bypass the caller-controlled BROWSERSLIST_DISABLE_CACHE mitigation and cause linear memory growth followed by an out-of-memory process crash. This issue is fixed in version 4.28.7.","status":"published","published":"2026-08-11T17:19:17.123Z","modified":"2026-09-09T20:44:04.357Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:12:36.880938Z"}],"osv":[{"id":"CVE-2026-73089","title":"Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM","description":"Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, index.js retains every distinct `(queries, context)` result in cache and every parseQueries() AST in parseCache without a size cap, TTL, or eviction, allowing an attacker who can influence repeated browserslist() query values, including valid since `\u003cyear\u003e-\u003cmonth\u003e-\u003cday\u003e` queries, to bypass the caller-controlled BROWSERSLIST_DISABLE_CACHE mitigation and cause linear memory growth followed by an out-of-memory process crash. This issue is fixed in version 4.28.7.","status":"published","published":"2026-08-11T17:05:38.76Z","modified":"2026-10-28T02:31:02.334527795Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:45:15.88521Z"},{"id":"DEBIAN-CVE-2026-73089","description":"Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, index.js retains every distinct `(queries, context)` result in cache and every parseQueries() AST in parseCache without a size cap, TTL, or eviction, allowing an attacker who can influence repeated browserslist() query values, including valid since `\u003cyear\u003e-\u003cmonth\u003e-\u003cday\u003e` queries, to bypass the caller-controlled BROWSERSLIST_DISABLE_CACHE mitigation and cause linear memory growth followed by an out-of-memory process crash. This issue is fixed in version 4.28.7.","status":"published","published":"2026-08-11T17:19:17.123Z","modified":"2026-10-01T03:03:33.663874738Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:46:02.499355Z"},{"id":"GHSA-c83g-rgw3-j3cx","title":"Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM","description":"## Vulnerability Details\n\n**File**: `index.js`\n**Location**: `cache` (browserslist()'s result cache, line ~402) and\n`parseCache` (parseQueries()'s AST cache)\n\n### Root Cause\n```js\nvar cache = {}\nvar parseCache = {}\n\nfunction browserslist(queries, opts) {\n  ...\n  var cacheKey = JSON.stringify([queries, context])\n  if (cache[cacheKey]) return cache[cacheKey]\n  ...\n  if (!env.env.BROWSERSLIST_DISABLE_CACHE) { cache[cacheKey] = result }\n  return result\n}\n\nfunction parseQueries(queries) {\n  var cacheKey = JSON.stringify(queries)\n  if (cacheKey in parseCache) return parseCache[cacheKey]\n  var result = parseWithoutCache(QUERIES, queries)\n  if (!env.env.BROWSERSLIST_DISABLE_CACHE) { parseCache[cacheKey] = result }\n  ...\n}\n```\nEvery distinct `(queries, context)` pair is cached forever — no size cap,\nTTL, or eviction. `browserslist.clearCaches()` never resets either object\n(it only resets `node.js`'s own filesystem caches); the only opt-out is the\n`BROWSERSLIST_DISABLE_CACHE` env var, controlled by the *calling\napplication*, not an attacker.\n\nSome short, valid queries amplify this badly. The `since \u003cyear\u003e-\u003cmonth\u003e-\u003cday\u003e`\nquery type (`/^since (\\d+)-(\\d+)-(\\d+)$/i`) accepts **any** digit\ncombination — `Date.UTC()` normalizes rather than rejects out-of-range\nvalues — giving an effectively unbounded space of ~17-byte distinct cache\nkeys, each of which resolves to (and caches) a result close to the full\n~8.5 KB browser list for any sufficiently old year.\n\n### Measured Impact\n20,000 distinct `since \u003cyear\u003e-\u003cmonth\u003e-\u003cday\u003e` queries (~330 KB total input,\n`--expose-gc` before/after measurement to rule out uncollected garbage)\nretained **over 50 MB** of heap permanently — roughly **150x**\namplification, growing linearly with no cap observed up to 40,000 queries\n(52.3 MB).\n\n### Attack Scenario\nAny long-running process (server, daemon, warm CI worker) that calls\n`browserslist()` with a query value that varies across requests/items and is\ninfluenced, even partially, by external input accumulates one cache entry\nper distinct value ever seen. An attacker who can influence that value\nacross *many* requests (this is a volumetric attack, unlike the\nsingle-request DoS findings from this same research pass) sends a stream of\ncheap, distinct queries (e.g. `since 1900-01-01`, `since 1900-01-02`, ...)\nuntil the process runs out of memory and crashes.\n\n### Recommended Fix (implemented and verified)\nReplace both plain-object caches with `Map`s bounded to a fixed maximum\nentry count, evicting the oldest entry once the cap is reached (`Map`\npreserves insertion order, so `.keys().next().value` is always oldest):\n\n```js\nvar CACHE_MAX_ENTRIES = 500\n\nfunction boundedCacheSet(map, key, value) {\n  if (map.size \u003e= CACHE_MAX_ENTRIES) {\n    map.delete(map.keys().next().value)\n  }\n  map.set(key, value)\n}\n\nvar cache = new Map()\nvar parseCache = new Map()\n```\n(read sites changed to `.has()`/`.get()`, write sites to `boundedCacheSet()`)\n\n**Verification**:\n- `NODE_ENV=test npx uvu test .test.js` → 301/301 pass unmodified\n  (`test/cache.test.js` exercises `clearCaches()`/`BROWSERSLIST_DISABLE_CACHE`\n  against `node.js`'s separate filesystem caches, unaffected here); confirmed\n  a repeated identical call still returns the cached reference.\n- Re-ran the memory PoC post-fix: heap stayed flat at ~4.9 MB after 5,000,\n  10,000, 20,000, and 40,000 distinct `since`-date queries (was\n  10.5 → 16.5 → 28.4 → 52.3 MB pre-fix).\n\n### Impact\n- **Who is affected**: Long-running processes calling `browserslist()` with\n  query values that vary across requests/items and are influenced by\n  external input.\n- **What an attacker achieves**: DoS via eventual out-of-memory crash, given\n  sustained traffic over time (not a single small payload).\n- **Conditions required**: No authentication; requires volume rather than a\n  single request, hence Medium rather than High severity.\n\n### Verification Environment\nbrowserslist @ HEAD (== v4.28.6, current latest stable release) under local\nNode.js v20.19.5, run with `--expose-gc` for accurate heap measurement.\n\n### Note\nFound during a broader review of this codebase in the same research pass\nthat produced GHSA-rrmg-cfrq-23vv (parse.js algorithmic complexity),\nGHSA-g6p8-hj8g-x889 (baseline regexp ReDoS), GHSA-73wf-gq98-2v4g\n(normalizeStats crash/prototype write), and GHSA-h633-868p-5rfw\n(SCOPED_CONFIG__PATTERN ReDoS) — all single-request DoS vectors. This one is\ndifferent in character (volumetric, not single-request) and is reported\nseparately/scored lower accordingly.","status":"published","published":"2026-09-01T16:42:13Z","modified":"2026-09-10T03:50:54.622936829Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:46:44.927642Z"},{"id":"RHSA-2026:54517","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-08-13T10:17:50Z","modified":"2026-10-20T10:11:09Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:54518","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-08-14T10:16:47Z","modified":"2026-10-20T10:11:09Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"UBUNTU-CVE-2026-73089","description":"Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, index.js retains every distinct `(queries, context)` result in cache and every parseQueries() AST in parseCache without a size cap, TTL, or eviction, allowing an attacker who can influence repeated browserslist() query values, including valid since `\u003cyear\u003e-\u003cmonth\u003e-\u003cday\u003e` queries, to bypass the caller-controlled BROWSERSLIST_DISABLE_CACHE mitigation and cause linear memory growth followed by an out-of-memory process crash. This issue is fixed in version 4.28.7.","status":"published","published":"2026-08-11T17:19:00Z","modified":"2026-08-19T11:11:14Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:57:08.628462Z"},{"id":"CLSA-2026-1790175511","title":"TuxCare security update for browserslist (1 CVE)","description":"TuxCare rebuilt browserslist to address 1 CVE. Fixed in 4.10.0-tuxcare.5.","status":"published","published":"2026-09-23T14:58:31Z","modified":"2026-10-15T09:47:56.697331955Z","updated_at":"2026-11-02T15:43:48.28229Z"},{"id":"CLSA-2026-1790175574","title":"TuxCare security update for browserslist (1 CVE)","description":"TuxCare rebuilt browserslist to address 1 CVE. Fixed in 4.14.2-tuxcare.3.","status":"published","published":"2026-09-23T14:59:34Z","modified":"2026-10-15T09:48:03.120572587Z","updated_at":"2026-11-02T15:43:48.28229Z"},{"id":"CLSA-2026-1790175577","title":"TuxCare security update for browserslist (2 CVEs)","description":"TuxCare rebuilt browserslist to address 2 CVEs. Fixed in 4.27.0-tuxcare.2.","status":"published","published":"2026-09-23T14:59:37Z","modified":"2026-10-15T09:48:03.104368116Z","updated_at":"2026-11-02T15:43:48.28229Z"},{"id":"CLSA-2026-1790177674","title":"TuxCare security update for browserslist (2 CVEs)","description":"TuxCare rebuilt browserslist to address 2 CVEs. Fixed in 4.13.0-tuxcare.3.","status":"published","published":"2026-09-23T15:34:34Z","modified":"2026-10-15T09:47:56.801925069Z","updated_at":"2026-11-02T15:43:48.28229Z"},{"id":"CLSA-2026-1790950178","title":"TuxCare security update for browserslist (1 CVE)","description":"TuxCare rebuilt browserslist to address 1 CVE. Fixed in 3.2.8-tuxcare.2.","status":"published","published":"2026-10-02T14:09:38Z","modified":"2026-10-15T09:47:38.669125547Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1790965158","title":"TuxCare security update for browserslist (1 CVE)","description":"TuxCare rebuilt browserslist to address 1 CVE. Fixed in 2.11.3-tuxcare.3.","status":"published","published":"2026-10-02T18:19:18Z","modified":"2026-10-15T09:47:38.666513083Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791199397","title":"TuxCare security update for browserslist (1 CVE)","description":"TuxCare rebuilt browserslist to address 1 CVE. Fixed in 4.24.4-tuxcare.2.","status":"published","published":"2026-10-05T11:23:17Z","modified":"2026-10-15T09:47:39.221572376Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791199466","title":"TuxCare security update for browserslist (2 CVEs)","description":"TuxCare rebuilt browserslist to address 2 CVEs. Fixed in 4.21.5-tuxcare.1.","status":"published","published":"2026-10-05T11:24:26Z","modified":"2026-10-15T09:47:39.28859623Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1792443101","title":"TuxCare security update for browserslist (2 CVEs)","description":"TuxCare rebuilt browserslist to address 2 CVEs. Fixed in 4.28.5-tuxcare.1.","status":"published","published":"2026-10-19T20:51:41Z","modified":"2026-10-20T01:45:08.297844633Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1792477554","title":"TuxCare security update for browserslist (2 CVEs)","description":"TuxCare rebuilt browserslist to address 2 CVEs. Fixed in 4.28.4-tuxcare.1.","status":"published","published":"2026-10-20T06:25:54Z","modified":"2026-10-20T07:15:15.38084078Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1792495777","title":"TuxCare security update for browserslist (2 CVEs)","description":"TuxCare rebuilt browserslist to address 2 CVEs. Fixed in 4.28.2-tuxcare.1.","status":"published","published":"2026-10-20T11:29:37Z","modified":"2026-10-20T13:45:18.46649554Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1792508656","title":"TuxCare security update for browserslist (1 CVE)","description":"TuxCare rebuilt browserslist to address 1 CVE. Fixed in 4.28.1-tuxcare.2.","status":"published","published":"2026-10-20T15:04:16Z","modified":"2026-10-20T19:30:16.377386405Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1793111870","title":"TuxCare security update for browserslist (1 CVE)","description":"TuxCare rebuilt browserslist to address 1 CVE. Fixed in 4.24.0-tuxcare.2.","status":"published","published":"2026-10-27T14:37:50Z","modified":"2026-10-27T19:30:03.2305865Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793180856","title":"TuxCare security update for browserslist (2 CVEs)","description":"TuxCare rebuilt browserslist to address 2 CVEs. Fixed in 4.23.3-tuxcare.1.","status":"published","published":"2026-10-28T09:47:36Z","modified":"2026-10-28T13:45:17.233010071Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793183890","title":"TuxCare security update for browserslist (1 CVE)","description":"TuxCare rebuilt browserslist to address 1 CVE. Fixed in 4.23.2-tuxcare.1.","status":"published","published":"2026-10-28T10:38:10Z","modified":"2026-10-28T13:45:14.318485069Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793187937","title":"TuxCare security update for browserslist (1 CVE)","description":"TuxCare rebuilt browserslist to address 1 CVE. Fixed in 4.23.1-tuxcare.1.","status":"published","published":"2026-10-28T11:45:37Z","modified":"2026-10-28T13:45:17.531372994Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793207044","title":"TuxCare security update for browserslist (1 CVE)","description":"TuxCare rebuilt browserslist to address 1 CVE. Fixed in 4.23.0-tuxcare.1.","status":"published","published":"2026-10-28T17:04:04Z","modified":"2026-10-28T19:45:12.037788505Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793209361","title":"TuxCare security update for browserslist (1 CVE)","description":"TuxCare rebuilt browserslist to address 1 CVE. Fixed in 4.21.10-tuxcare.1.","status":"published","published":"2026-10-28T17:42:41Z","modified":"2026-10-28T19:45:12.038120336Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1794048476","title":"TuxCare security update for browserslist (2 CVEs)","description":"TuxCare rebuilt browserslist to address 2 CVEs. Fixed in 4.18.1-tuxcare.1.","status":"published","published":"2026-11-07T11:47:57Z","modified":"2026-11-07T13:15:02.326575687Z","updated_at":"2026-11-07T13:47:00.167603Z"},{"id":"openSUSE-SU-2026:11680-1","title":"agama-web-ui-24+0.a836cced5-52.1 on GA media","description":"These are all security issues fixed in the agama-web-ui-24+0.a836cced5-52.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-04T00:00:00Z","modified":"2026-09-05T09:45:03.960220408Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:21602-1","title":"Security update for python-pytest-html","description":"This update for python-pytest-html fixes the following issues:\n\nChanges in python-pytest-html:\n\n- Revendor browserslist to fix the following:\n  * CVE-2026-73088: unguarded for...in loop over untrusted JSON keys in normalizeStats() function leads to prototype pollution and uncaught exceptions (bsc#1275374)\n  * CVE-2026-73089: unbounded in-memory caching of query pairs in browserslist() can lead to DoS via memory exhaustion through a high volume of distinct queries (bsc#1275437)\n","status":"published","published":"2026-08-18T15:53:05Z","modified":"2026-08-21T09:15:07.245549505Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"ROOT-APP-NPM-CVE-2026-73089","title":"CVE-2026-73089 in browserslist - Patched by Root","description":"Root has patched CVE-2026-73089 in the browserslist package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-09-23T14:51:12Z","modified":"2026-09-23T15:15:03.254295202Z","updated_at":"2026-11-02T15:53:27.649662Z"}]}}