Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, index.js retains every distinct `(queries, context)` result in cache and every parseQueries() AST in parseCache without a size cap, TTL, or eviction, allowing an attacker who can influence repeated browserslist() query values, including valid since `<year>-<month>-<day>` queries, to bypass the caller-controlled BROWSERSLIST_DISABLE_CACHE mitigation and cause linear memory growth followed by an out-of-memory process crash. This issue is fixed in version 4.28.7.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-08-11 | 1 | Disclosure1 |
| 2026-09-01 | 1 | General1 |
| 2026-09-02 | 1 | Patch1 |
DID YOU KNOW? n8n 1.123.76 bumps browserslist to 4.28.7, fixing CVE-2026-73088 and CVE-2026-73089. Update your n8n instance to close this security gap. https://github.com/n8n-io/n8n/releases/tag/n8n%401.123.76
Post summary
A new n8n release patches CVE-2026-73088 and CVE-2026-73089, urging users to update the software.
🟠 Browserslist, Unbounded Memory Growth (No Cache Eviction), #CVE-2026-73089 (Medium) -DC-Sep2026-2060 https://dailycve.com/browserslist-unbounded-memory-growth-no-cache-eviction-cve-2026-73089-medium-dc-sep2026-2060/
Post summary
The tweet merely announces the existence and medium severity of CVE-2026-73089 without providing details on exploitation, PoC, or remediation.
CVE-2026-73089 Browserslist Denial-of-Service via Unbounded Cache Growth https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-73089
Post summary
The text announces CVE-2026-73089 as a Denial‑of‑Service vulnerability in Browserslist caused by unbounded cache growth, with no evidence of PoC, exploit, active use, or patch details.