CVE-2026-73089: Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM

September 1, 2026

Who is affected: Long-running processes calling browserslist() with query values that vary across requests/items and are influenced by external input.
What an attacker achieves: DoS via eventual out-of-memory crash, given sustained traffic over time (not a single small payload).
Conditions required: No authentication; requires volume rather than a single request, hence Medium rather than High severity.

References

github.com/advisories/GHSA-c83g-rgw3-j3cx
github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405
github.com/browserslist/browserslist/releases/tag/4.28.7
github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx
nvd.nist.gov/vuln/detail/CVE-2026-73089

Code Behaviors & Features

Detect and mitigate CVE-2026-73089 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →