REDHAT-BUG-2514195: High severity npm/browserslist vulnerability
Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, index.js retains every distinct (queries, context) result in cache and every parseQueries() AST in parseCache without a size cap, TTL, or eviction, allowing an attacker who can influence repeated browserslist() query values, including valid since <year>-<month>-<day> queries, to bypass the caller-controlled BROWSERSLISTDISABLECACHE mitigation and cause linear memory growth followed by an out-of-memory process crash. This issue is fixed in version 4.28.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
browserslistto a version that resolves this vulnerability.Fixed in 4.28.7
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using Browserslist before 4.28.7 are exposed if an attacker can influence repeated values passed to browserslist() queries. Valid date-based queries such as since <year>-<month>-<day> can be used to create distinct cache entries.
Does disabling the Browserslist cache prevent exploitation?
No. An attacker can bypass the caller-controlled BROWSERSLIST_DISABLE_CACHE mitigation because index.js retains distinct query and context results and parseQueries() ASTs without a size limit, TTL, or eviction.
What is the impact of successful exploitation?
Repeated distinct queries cause linear memory growth. This can exhaust process memory and crash the affected process.
What should be done to remediate the issue?
Update Browserslist to version 4.28.7, which fixes the unbounded cache behavior.