Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Vulnerability Details File: index.js Location: cache (browserslist()'s result cache, line ~402) and parseCache (parseQueries()'s AST cache) Root Cause Every distinct (queries, context) pair is cached forever — no size cap, TTL, or eviction. browserslist.clearCaches() never resets either object (it only resets node.js's own filesystem caches); the only opt-out is the BROWSERSLISTDISABLECACHE env var, controlled by the calling application, not an attacker. Some short, valid queries amplify this badly. The since <year-<month-<day query type (/^since (\d+)-(\d+)-(\d+)$/i) accepts any digit combination — Date.UTC() normalizes rather than rejects out-of-range values — giving an effectively unbounded space of ~17-byte distinct cache keys, each of which resolves to (and caches) a result close to the full ~8.5 KB browser list for any sufficiently old year. Measured Impact 20,000 distinct since <year-<month-<day queries (~330 KB total input, --expose-gc before/after measurement to rule out…
Recommended action: Upgrade to 4.28.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Vulnerability Details File: node.js Function: normalizeStats() (line ~214), reached from getStat() (called unconditionally on every browserslist() call) and loadStat() Root Cause stats is untrusted: it comes from JSON.parse()-ing a browserslist-stats.json file — auto-discovered by walking up the directory tree from the project root on every browserslist() call, regardless of the query (env.getStat(opts, browserslist.data) runs unconditionally inside browserslist()) — or from opts.stats passed programmatically / via the CLI's --stats= flag. data is browserslist.data, a plain object populated only with real browser names. Two independent bugs from the same root cause (unguarded for...in over untrusted keys used with plain-object bracket access/assignment): 1. Crash: data[i] has no hasOwnProperty guard. If stats contains a key that also happens to be an inherited Object.prototype member name — "proto", "toString", "valueOf", "constructor", "hasOwnProperty", "isPrototypeOf", etc. —…
Recommended action: Upgrade to 4.28.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The package browserslist from 4.0.0 and before 4.16.5 are vulnerable to Regular Expression Denial of Service (ReDoS) during parsing of queries.
Recommended action: Upgrade to 4.16.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.