CVE-2026-73089: Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM

Who is affected: Long-running processes calling browserslist() with query values that vary across requests/items and are influenced by external input.
What an attacker achieves: DoS via eventual out-of-memory crash, given sustained traffic over time (not a single small payload).
Conditions required: No authentication; requires volume rather than a single request, hence Medium rather than High severity.

September 1, 2026

References

Code Behaviors & Features

Detect and mitigate CVE-2026-73089 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →