High [CVE-2026-73089] Denial of Service via unbounded memory growth from distinct query results

Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools.

Prior to 4.28.7, index.js retains every distinct `(queries, context)` result in cache and every parseQueries() AST in parseCache without a size cap, TTL, or eviction, allowing an attacker who can influence repeated browserslist() query values, including valid since `--` queries, to bypass the caller-controlled BROWSERSLIST_DISABLE_CACHE mitigation and cause linear memory growth followed by an out-of-memory process crash.

This issue is fixed in version 4.28.7. This issue can cause the application to consume excessive memory, resulting in an out-of-memory process crash and a Denial of Service (DoS) for affected systems.

This is an Important denial of service vulnerability in the `browserslist` library, which is used across several Red Hat products and services. The flaw allows an attacker to trigger unbounded memory growth by influencing query values, potentially leading to an out-of-memory crash and service unavailability.

This is considered Important due to the potential for remote exploitation and significant impact on service stability. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

Weakness: CWE-770.