CyberRota Analysis
AI-GeneratedBrowserslist versions prior to 4.28.7 are vulnerable to a memory management issue that allows attackers to exploit the caching mechanism, leading to linear memory growth and potential out-of-memory crashes. This vulnerability can be triggered by manipulating repeated query values, including date-based queries, which bypasses existing cache mitigation strategies. Organizations using affected versions should prioritize upgrading to 4.28.7 to mitigate the risk of service disruptions and potential denial of service.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, index.js retains every distinct `(queries, context)` result in cache and every parseQueries() AST in parseCache without a size cap, TTL, or eviction, allowing an attacker who can influence repeated browserslist() query values, including valid since `<year>-<month>-<day>` queries, to bypass the caller-controlled BROWSERSLIST_DISABLE_CACHE mitigation and cause linear memory growth followed by an out-of-memory process crash. This issue is fixed in version 4.28.7.