{
"vulnerabilities": [
{
"id": "SNYK-UBUNTU2204-NODEJS-17268893",
"cpes": [],
"title": "CVE-2026-45447",
"CVSSv3": null,
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": null,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-45447",
"title": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-45447"
},
{
"url": "https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c",
"title": "https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c"
},
{
"url": "https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8",
"title": "https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8"
},
{
"url": "https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54",
"title": "https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54"
},
{
"url": "https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c",
"title": "https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c"
},
{
"url": "https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e",
"title": "https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e"
},
{
"url": "https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c",
"title": "https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c"
},
{
"url": "https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8",
"title": "https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8"
},
{
"url": "https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54",
"title": "https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54"
},
{
"url": "https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c",
"title": "https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c"
},
{
"url": "https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e",
"title": "https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e"
},
{
"url": "https://openssl-library.org/news/secadv/20260609.txt",
"title": "https://openssl-library.org/news/secadv/20260609.txt"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:25237",
"title": "https://access.redhat.com/errata/RHSA-2026:25237"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:25239",
"title": "https://access.redhat.com/errata/RHSA-2026:25239"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:26275",
"title": "https://access.redhat.com/errata/RHSA-2026:26275"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:26319",
"title": "https://access.redhat.com/errata/RHSA-2026:26319"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:29197",
"title": "https://access.redhat.com/errata/RHSA-2026:29197"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:34102",
"title": "https://access.redhat.com/errata/RHSA-2026:34102"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:35869",
"title": "https://access.redhat.com/errata/RHSA-2026:35869"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:36215",
"title": "https://access.redhat.com/errata/RHSA-2026:36215"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:36217",
"title": "https://access.redhat.com/errata/RHSA-2026:36217"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:39009",
"title": "https://access.redhat.com/errata/RHSA-2026:39009"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:39012",
"title": "https://access.redhat.com/errata/RHSA-2026:39012"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:39981",
"title": "https://access.redhat.com/errata/RHSA-2026:39981"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-45447",
"title": "https://access.redhat.com/security/cve/CVE-2026-45447"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481898",
"title": "https://bugzilla.redhat.com/show_bug.cgi?id=2481898"
},
{
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json",
"title": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:44438",
"title": "https://access.redhat.com/errata/RHSA-2026:44438"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:47735",
"title": "https://access.redhat.com/errata/RHSA-2026:47735"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:47737",
"title": "https://access.redhat.com/errata/RHSA-2026:47737"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:58563",
"title": "https://access.redhat.com/errata/RHSA-2026:58563"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:58981",
"title": "https://access.redhat.com/errata/RHSA-2026:58981"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:59831",
"title": "https://access.redhat.com/errata/RHSA-2026:59831"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 8.1,
"modificationTime": "2026-06-11T05:27:17.177297Z"
},
{
"assigner": "SUSE",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-06-16T11:02:09.225251Z"
}
],
"cvssSources": [
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-06-11T05:27:17.177297Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "SUSE",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-06-16T11:02:09.225251Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `nodejs` package and not the `nodejs` package as distributed by `Ubuntu`._\n_See `How to fix?` for `Ubuntu:22.04` relevant fixed versions and status._\n\nIssue summary: A specially crafted PKCS#7 or S/MIME signed message could\ntrigger a use-after-free during PKCS#7 signature verification.\n\nImpact summary: A use-after-free may result in process crashes, heap\ncorruption, or potentially remote code execution.\n\nWhen processing a PKCS#7 or S/MIME signed message, if the SignedData\ndigestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may\nincorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent\nuse of the BIO by the calling application results in a use-after-free\ncondition.\n\nIn the common case this occurs when the application later calls\nBIO_free() on the BIO originally passed to PKCS7_verify(). Depending\non allocator behavior and application-specific BIO usage patterns, this\nmay result in a crash or other memory corruption. In some application\ncontexts this may potentially be exploitable for remote code execution.\n\nApplications that process PKCS#7 or S/MIME signed messages using OpenSSL\nPKCS#7 APIs may be affected. Applications using the CMS APIs for this\nprocessing are not affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.\n## Remediation\nThere is no fixed version for `Ubuntu:22.04` `nodejs`.\n## References\n- [http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-45447](http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-45447)\n- [https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c](https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c)\n- [https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8](https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8)\n- [https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54](https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54)\n- [https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c](https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c)\n- [https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e](https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e)\n- [https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c](https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c)\n- [https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8](https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8)\n- [https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54](https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54)\n- [https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c](https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c)\n- [https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e](https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e)\n- [https://openssl-library.org/news/secadv/20260609.txt](https://openssl-library.org/news/secadv/20260609.txt)\n- [https://access.redhat.com/errata/RHSA-2026:25237](https://access.redhat.com/errata/RHSA-2026:25237)\n- [https://access.redhat.com/errata/RHSA-2026:25239](https://access.redhat.com/errata/RHSA-2026:25239)\n- [https://access.redhat.com/errata/RHSA-2026:26275](https://access.redhat.com/errata/RHSA-2026:26275)\n- [https://access.redhat.com/errata/RHSA-2026:26319](https://access.redhat.com/errata/RHSA-2026:26319)\n- [https://access.redhat.com/errata/RHSA-2026:29197](https://access.redhat.com/errata/RHSA-2026:29197)\n- [https://access.redhat.com/errata/RHSA-2026:34102](https://access.redhat.com/errata/RHSA-2026:34102)\n- [https://access.redhat.com/errata/RHSA-2026:35869](https://access.redhat.com/errata/RHSA-2026:35869)\n- [https://access.redhat.com/errata/RHSA-2026:36215](https://access.redhat.com/errata/RHSA-2026:36215)\n- [https://access.redhat.com/errata/RHSA-2026:36217](https://access.redhat.com/errata/RHSA-2026:36217)\n- [https://access.redhat.com/errata/RHSA-2026:39009](https://access.redhat.com/errata/RHSA-2026:39009)\n- [https://access.redhat.com/errata/RHSA-2026:39012](https://access.redhat.com/errata/RHSA-2026:39012)\n- [https://access.redhat.com/errata/RHSA-2026:39981](https://access.redhat.com/errata/RHSA-2026:39981)\n- [https://access.redhat.com/security/cve/CVE-2026-45447](https://access.redhat.com/security/cve/CVE-2026-45447)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2481898](https://bugzilla.redhat.com/show_bug.cgi?id=2481898)\n- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json)\n- [https://access.redhat.com/errata/RHSA-2026:44438](https://access.redhat.com/errata/RHSA-2026:44438)\n- [https://access.redhat.com/errata/RHSA-2026:47735](https://access.redhat.com/errata/RHSA-2026:47735)\n- [https://access.redhat.com/errata/RHSA-2026:47737](https://access.redhat.com/errata/RHSA-2026:47737)\n- [https://access.redhat.com/errata/RHSA-2026:58563](https://access.redhat.com/errata/RHSA-2026:58563)\n- [https://access.redhat.com/errata/RHSA-2026:58981](https://access.redhat.com/errata/RHSA-2026:58981)\n- [https://access.redhat.com/errata/RHSA-2026:59831](https://access.redhat.com/errata/RHSA-2026:59831)\n",
"epssDetails": {
"percentile": "0.88452",
"probability": "0.03566",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-45447"
],
"CWE": [],
"ALTERNATIVE": []
},
"nvdSeverity": null,
"packageName": "nodejs",
"creationTime": "2026-06-10T02:46:34.655313Z",
"disclosureTime": "2026-06-09T17:17:19.277000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "ubuntu:22.04",
"publicationTime": "2026-06-10T02:46:34.660471Z",
"severityBasedOn": "Relative Importance",
"modificationTime": "2026-09-05T01:30:40.708579Z",
"socialTrendAlert": false,
"relativeImportance": "high",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-wlc2-api@2.50.6_def3651.4115",
"nodejs@24.19.0-1nodesource1"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "nodejs",
"version": "24.19.0-1nodesource1"
}
],
"ok": false,
"dependencyCount": 170,
"org": "sean.graham",
"policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n",
"isPrivate": true,
"licensesPolicy": {
"severities": {},
"orgLicenseRules": {
"AGPL-1.0": {
"licenseType": "AGPL-1.0",
"severity": "high",
"instructions": ""
},
"AGPL-3.0": {
"licenseType": "AGPL-3.0",
"severity": "high",
"instructions": ""
},
"Artistic-1.0": {
"licenseType": "Artistic-1.0",
"severity": "medium",
"instructions": ""
},
"Artistic-2.0": {
"licenseType": "Artistic-2.0",
"severity": "medium",
"instructions": ""
},
"CDDL-1.0": {
"licenseType": "CDDL-1.0",
"severity": "medium",
"instructions": ""
},
"CPOL-1.02": {
"licenseType": "CPOL-1.02",
"severity": "high",
"instructions": ""
},
"EPL-1.0": {
"licenseType": "EPL-1.0",
"severity": "medium",
"instructions": ""
},
"GPL-2.0": {
"licenseType": "GPL-2.0",
"severity": "high",
"instructions": ""
},
"GPL-3.0": {
"licenseType": "GPL-3.0",
"severity": "high",
"instructions": ""
},
"LGPL-2.0": {
"licenseType": "LGPL-2.0",
"severity": "medium",
"instructions": ""
},
"LGPL-2.1": {
"licenseType": "LGPL-2.1",
"severity": "medium",
"instructions": ""
},
"LGPL-3.0": {
"licenseType": "LGPL-3.0",
"severity": "medium",
"instructions": ""
},
"MPL-1.1": {
"licenseType": "MPL-1.1",
"severity": "medium",
"instructions": ""
},
"MPL-2.0": {
"licenseType": "MPL-2.0",
"severity": "medium",
"instructions": ""
},
"MS-RL": {
"licenseType": "MS-RL",
"severity": "medium",
"instructions": ""
},
"SimPL-2.0": {
"licenseType": "SimPL-2.0",
"severity": "high",
"instructions": ""
}
}
},
"packageManager": "deb",
"ignoreSettings": {
"adminOnly": false,
"reasonRequired": false,
"disregardFilesystemIgnores": false,
"autoApproveIgnores": false,
"approvalWorkflowEnabled": false
},
"docker": {
"binariesVulns": {
"issuesData": {},
"affectedPkgs": {}
},
"os": {
"prettyName": "Ubuntu 22.04.5 LTS"
}
},
"summary": "1 high or critical severity vulnerable dependency path",
"severityThreshold": "high",
"filesystemPolicy": false,
"filtered": {
"ignore": [],
"patch": []
},
"uniqueCount": 1,
"projectName": "docker-image|docker.io/scopear/docker-wlc2-api",
"platform": "linux/amd64",
"hasUnknownVersions": false,
"path": "docker.io/scopear/docker-wlc2-api:2.50.6_def3651.4115/scopear/docker-wlc2-api",
"applications": [
{
"vulnerabilities": [
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@babel/helper-define-polyfill-provider@0.6.8",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@babel/helper-define-polyfill-provider@0.6.8",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@babel/helper-define-polyfill-provider@0.6.8",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@babel/helper-define-polyfill-provider@0.6.8",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@babel/plugin-transform-classes@7.28.6",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@babel/plugin-transform-classes@7.28.6",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@babel/plugin-transform-classes@7.28.6",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@babel/plugin-transform-classes@7.28.6",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@babel/plugin-transform-function-name@7.27.1",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@babel/plugin-transform-function-name@7.27.1",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@babel/plugin-transform-function-name@7.27.1",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@babel/plugin-transform-function-name@7.27.1",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@babel/plugin-transform-object-rest-spread@7.28.6",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@babel/plugin-transform-object-rest-spread@7.28.6",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@babel/plugin-transform-object-rest-spread@7.28.6",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@babel/plugin-transform-object-rest-spread@7.28.6",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@babel/preset-env@7.29.2",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@babel/preset-env@7.29.2",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@babel/preset-env@7.29.2",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@babel/preset-env@7.29.2",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@babel/preset-env@7.29.2",
"core-js-compat@3.49.0",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@babel/preset-env@7.29.2",
"core-js-compat@3.50.0",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@babel/preset-env@7.29.2",
"core-js-compat@3.49.0",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@babel/preset-env@7.29.2",
"core-js-compat@3.50.0",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@babel/preset-env@7.29.2",
"@babel/plugin-transform-classes@7.28.6",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@babel/preset-env@7.29.2",
"@babel/plugin-transform-classes@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@babel/preset-env@7.29.2",
"@babel/plugin-transform-classes@7.28.6",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@babel/preset-env@7.29.2",
"@babel/plugin-transform-classes@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@babel/preset-env@7.29.2",
"@babel/plugin-transform-function-name@7.27.1",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@babel/preset-env@7.29.2",
"@babel/plugin-transform-function-name@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@babel/preset-env@7.29.2",
"@babel/plugin-transform-function-name@7.27.1",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@babel/preset-env@7.29.2",
"@babel/plugin-transform-function-name@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@babel/preset-env@7.29.2",
"@babel/plugin-transform-object-rest-spread@7.28.6",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@babel/preset-env@7.29.2",
"@babel/plugin-transform-object-rest-spread@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@babel/preset-env@7.29.2",
"@babel/plugin-transform-object-rest-spread@7.28.6",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@babel/preset-env@7.29.2",
"@babel/plugin-transform-object-rest-spread@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@babel/preset-env@7.29.2",
"babel-plugin-polyfill-corejs3@0.14.2",
"core-js-compat@3.49.0",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@babel/preset-env@7.29.2",
"babel-plugin-polyfill-corejs3@0.14.2",
"core-js-compat@3.50.0",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@babel/preset-env@7.29.2",
"babel-plugin-polyfill-corejs3@0.14.2",
"core-js-compat@3.49.0",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@babel/preset-env@7.29.2",
"babel-plugin-polyfill-corejs3@0.14.2",
"core-js-compat@3.50.0",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-config@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-config@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"create-jest@29.7.0",
"jest-config@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"create-jest@29.7.0",
"jest-config@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"create-jest@29.7.0",
"jest-config@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"create-jest@29.7.0",
"jest-config@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@babel/preset-env@7.29.2",
"babel-plugin-polyfill-corejs2@0.4.17",
"@babel/helper-define-polyfill-provider@0.6.8",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@babel/preset-env@7.29.2",
"babel-plugin-polyfill-corejs2@0.4.17",
"@babel/helper-define-polyfill-provider@0.6.8",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@babel/preset-env@7.29.2",
"babel-plugin-polyfill-corejs2@0.4.17",
"@babel/helper-define-polyfill-provider@0.6.8",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@babel/preset-env@7.29.2",
"babel-plugin-polyfill-corejs2@0.4.17",
"@babel/helper-define-polyfill-provider@0.6.8",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@babel/preset-env@7.29.2",
"babel-plugin-polyfill-corejs3@0.14.2",
"@babel/helper-define-polyfill-provider@0.6.8",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@babel/preset-env@7.29.2",
"babel-plugin-polyfill-corejs3@0.14.2",
"@babel/helper-define-polyfill-provider@0.6.8",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@babel/preset-env@7.29.2",
"babel-plugin-polyfill-corejs3@0.14.2",
"@babel/helper-define-polyfill-provider@0.6.8",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@babel/preset-env@7.29.2",
"babel-plugin-polyfill-corejs3@0.14.2",
"@babel/helper-define-polyfill-provider@0.6.8",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@babel/preset-env@7.29.2",
"babel-plugin-polyfill-regenerator@0.6.8",
"@babel/helper-define-polyfill-provider@0.6.8",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@babel/preset-env@7.29.2",
"babel-plugin-polyfill-regenerator@0.6.8",
"@babel/helper-define-polyfill-provider@0.6.8",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@babel/preset-env@7.29.2",
"babel-plugin-polyfill-regenerator@0.6.8",
"@babel/helper-define-polyfill-provider@0.6.8",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@babel/preset-env@7.29.2",
"babel-plugin-polyfill-regenerator@0.6.8",
"@babel/helper-define-polyfill-provider@0.6.8",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"@jest/reporters@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"@jest/reporters@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"@jest/reporters@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"@jest/reporters@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"@jest/reporters@29.7.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"@jest/reporters@29.7.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"@jest/reporters@29.7.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"@jest/reporters@29.7.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-resolve-dependencies@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-resolve-dependencies@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-resolve-dependencies@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-resolve-dependencies@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"@jest/reporters@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"@jest/reporters@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"@jest/reporters@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"@jest/reporters@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"create-jest@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"create-jest@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"create-jest@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"create-jest@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-resolve-dependencies@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-resolve-dependencies@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-resolve-dependencies@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-resolve-dependencies@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"@jest/reporters@29.7.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"@jest/reporters@29.7.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"@jest/reporters@29.7.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"@jest/reporters@29.7.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-resolve-dependencies@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-resolve-dependencies@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-resolve-dependencies@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-resolve-dependencies@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"@jest/reporters@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"@jest/reporters@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"@jest/reporters@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"@jest/reporters@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"create-jest@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"create-jest@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"create-jest@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"create-jest@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"@jest/reporters@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"@jest/reporters@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"@jest/reporters@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"@jest/reporters@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-resolve-dependencies@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-resolve-dependencies@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-resolve-dependencies@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-resolve-dependencies@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"@jest/reporters@29.7.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"@jest/reporters@29.7.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"@jest/reporters@29.7.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"@jest/reporters@29.7.0",
"istanbul-lib-instrument@6.0.3",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-resolve-dependencies@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-resolve-dependencies@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-resolve-dependencies@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-resolve-dependencies@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"@jest/reporters@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"@jest/reporters@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"@jest/reporters@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"@jest/reporters@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"create-jest@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"create-jest@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"create-jest@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"create-jest@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-resolve-dependencies@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-resolve-dependencies@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-resolve-dependencies@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-resolve-dependencies@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-resolve-dependencies@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-resolve-dependencies@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-resolve-dependencies@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-resolve-dependencies@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"@jest/reporters@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"@jest/reporters@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"@jest/reporters@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"@jest/reporters@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-resolve-dependencies@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-resolve-dependencies@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-resolve-dependencies@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-resolve-dependencies@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-resolve-dependencies@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-resolve-dependencies@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-resolve-dependencies@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-resolve-dependencies@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "browserslist",
"version": "4.28.2"
},
{
"id": "SNYK-JS-EXTRACTZIP-17660777",
"title": "Directory Traversal",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"credit": [
"Ziad Salah"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.6,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "extract-zip",
"references": [
{
"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-177-01.json",
"title": "Advisory"
},
{
"url": "https://github.com/ziad626/extract-zip-security-research/security/advisories/GHSA-x7jf-2287-qcpf",
"title": "GitHub Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"cvssV3BaseScore": 8.1,
"modificationTime": "2026-06-30T07:17:19.904850Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.6,
"cvssVersion": "4.0",
"modificationTime": "2026-07-24T14:06:06.638835Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-07-24T14:06:06.638835Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-06-30T07:17:19.904850Z"
}
],
"description": "## Overview\n[extract-zip](https://www.npmjs.org/package/extract-zip) is an unzip a zip file into a directory using 100% javascript\n\nAffected versions of this package are vulnerable to Directory Traversal via the extraction process. An attacker can access or modify arbitrary files by crafting a malicious zip archive containing symlinks that point outside the intended extraction directory.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nThere is no fixed version for `extract-zip`.\n## References\n- [Advisory](https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-177-01.json)\n- [GitHub Advisory](https://github.com/ziad626/extract-zip-security-research/security/advisories/GHSA-x7jf-2287-qcpf)\n",
"epssDetails": {
"percentile": "0.31654",
"probability": "0.00391",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-56876"
],
"CWE": [
"CWE-22"
],
"GHSA": [
"GHSA-x7jf-2287-qcpf"
]
},
"packageName": "extract-zip",
"proprietary": false,
"creationTime": "2026-06-28T07:51:29.464799Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-26T18:15:06Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-28T07:51:29.629427Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-07-24T14:06:06.638835Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@types/extract-zip@2.0.3",
"extract-zip@2.0.1"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "extract-zip",
"version": "2.0.1"
},
{
"id": "SNYK-JS-EXTRACTZIP-19653641",
"title": "Directory Traversal",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
"credit": [],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 7.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "extract-zip",
"references": [
{
"url": "https://github.com/max-mapper/extract-zip/commit/f27984342f2e12acac1615090592460cd456e650",
"title": "GitHub Commit"
},
{
"url": "https://github.com/max-mapper/extract-zip/pull/160",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
"cvssV3BaseScore": 8.1,
"modificationTime": "2026-08-28T05:32:37.302301Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.2,
"cvssVersion": "4.0",
"modificationTime": "2026-09-09T14:54:23.322433Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-09-09T14:54:23.322433Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-08-28T05:32:37.302301Z"
}
],
"description": "## Overview\n[extract-zip](https://www.npmjs.org/package/extract-zip) is an unzip a zip file into a directory using 100% javascript\n\nAffected versions of this package are vulnerable to Directory Traversal through the archive extraction logic in `index.js`. An attacker can write a file outside the destination directory by supplying an archive with two entries that reuse the same path: a symlink pointing outside the extraction root, followed by a regular file for that same name. During extraction, the code only checked the parent directory of each entry and then wrote the file through the existing final path component, so the second entry followed the planted symlink and overwrote the symlink target. This can corrupt or replace files writable by the process running `extract-zip`.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nA fix was pushed into the `master` branch but not yet published.\n## References\n- [GitHub Commit](https://github.com/max-mapper/extract-zip/commit/f27984342f2e12acac1615090592460cd456e650)\n- [GitHub PR](https://github.com/max-mapper/extract-zip/pull/160)\n",
"epssDetails": {
"percentile": "0.20481",
"probability": "0.00280",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-19693"
],
"CWE": [
"CWE-22"
],
"GHSA": [
"GHSA-7pqw-9j4j-h8q3"
]
},
"packageName": "extract-zip",
"proprietary": false,
"creationTime": "2026-09-09T14:54:22.763062Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-17T15:30:40Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-09T14:54:23.005562Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-09T14:54:23.322433Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@types/extract-zip@2.0.3",
"extract-zip@2.0.1"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "extract-zip",
"version": "2.0.1"
},
{
"id": "SNYK-JS-IMAGESIZE-17295814",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Proof of Concept",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "image-size",
"references": [
{
"url": "https://web.archive.org/web/20260224152152/https://github.com/image-size/image-size/pull/439",
"title": "GitHub PR"
},
{
"url": "https://joshua.hu/image-size-infinite-loop-dos-vulnerabilities",
"title": "Vulnerability Report"
},
{
"url": "https://codeberg.org/image-size/image-size/src/branch/main/lib/types/jxl.ts%23L21",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-06-16T14:58:03.788412Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-06-11T01:23:00.766258Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-05T02:01:24.424560Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T02:01:24.424560Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-06-16T14:58:03.788412Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-06-11T01:23:00.766258Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Infinite loop in the `extractPartialStreams()` and corresponding extraction functions for HEIF, JP2, and JXL. An attacker supplying an image whose requested box declares a size of zero can hang the parser indefinitely.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2025-71319](https://security.snyk.io/vuln/SNYK-JS-IMAGESIZE-9634164).\n## Remediation\nThere is no fixed version for `image-size`.\n## References\n- [GitHub PR](https://web.archive.org/web/20260224152152/https://github.com/image-size/image-size/pull/439)\n- [Vulnerability Report](https://joshua.hu/image-size-infinite-loop-dos-vulnerabilities)\n- [Vulnerable Code](https://codeberg.org/image-size/image-size/src/branch/main/lib/types/jxl.ts#L21)\n",
"epssDetails": {
"percentile": "0.34280",
"probability": "0.00430",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2025-71329"
],
"CWE": [
"CWE-835"
]
},
"packageName": "image-size",
"proprietary": false,
"creationTime": "2026-06-11T10:39:40.827383Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-10T14:38:17Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-11T10:39:40.987645Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-05T02:01:24.424560Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"image-size@2.0.2"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "image-size",
"version": "2.0.2"
},
{
"id": "SNYK-JS-IMAGESIZE-17295816",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Proof of Concept",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "image-size",
"references": [
{
"url": "https://web.archive.org/web/20260224152152/https://github.com/image-size/image-size/pull/439",
"title": "GitHub PR"
},
{
"url": "https://joshua.hu/image-size-infinite-loop-dos-vulnerabilities",
"title": "Vulnerability Report"
},
{
"url": "https://codeberg.org/image-size/image-size/src/branch/main/lib/types/icns.ts%23L94",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-06-16T14:56:48.045341Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-06-11T01:22:58.500245Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-11T02:01:08.848643Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-11T02:01:08.848643Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-06-16T14:56:48.045341Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-06-11T01:22:58.500245Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Infinite loop in `icns.js`. An ICNS file with an icon entry whose declared length is zero can hang the parser indefinitely.\n## Remediation\nThere is no fixed version for `image-size`.\n## References\n- [GitHub PR](https://web.archive.org/web/20260224152152/https://github.com/image-size/image-size/pull/439)\n- [Vulnerability Report](https://joshua.hu/image-size-infinite-loop-dos-vulnerabilities)\n- [Vulnerable Code](https://codeberg.org/image-size/image-size/src/branch/main/lib/types/icns.ts#L94)\n",
"epssDetails": {
"percentile": "0.34280",
"probability": "0.00430",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2025-71330"
],
"CWE": [
"CWE-835"
]
},
"packageName": "image-size",
"proprietary": false,
"creationTime": "2026-06-11T10:43:12.039483Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-10T14:38:09Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-11T10:43:12.497488Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-11T02:01:08.848643Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"image-size@2.0.2"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "image-size",
"version": "2.0.2"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@eslint/eslintrc@2.1.4",
"js-yaml@4.3.0"
],
"upgradePath": [
false,
"@eslint/eslintrc@2.1.4",
"js-yaml@4.3.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "4.3.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@eslint/eslintrc@2.1.4",
"js-yaml@4.3.0"
],
"upgradePath": [
false,
"@eslint/eslintrc@2.1.4",
"js-yaml@4.3.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "4.3.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"eslint@8.57.1",
"js-yaml@4.3.0"
],
"upgradePath": [
false,
"eslint@10.0.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "4.3.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"eslint@8.57.1",
"js-yaml@4.3.0"
],
"upgradePath": [
false,
"eslint@10.0.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "4.3.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"eslint@8.57.1",
"@eslint/eslintrc@2.1.4",
"js-yaml@4.3.0"
],
"upgradePath": [
false,
"eslint@10.0.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "4.3.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"eslint@8.57.1",
"@eslint/eslintrc@2.1.4",
"js-yaml@4.3.0"
],
"upgradePath": [
false,
"eslint@10.0.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "4.3.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"@jest/reporters@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"@jest/reporters@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"@jest/reporters@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"@jest/reporters@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"create-jest@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"create-jest@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"create-jest@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"create-jest@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"@jest/reporters@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"@jest/reporters@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"@jest/reporters@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"@jest/reporters@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"create-jest@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"create-jest@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"create-jest@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"create-jest@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-resolve-dependencies@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-resolve-dependencies@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-resolve-dependencies@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-resolve-dependencies@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"@jest/reporters@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"@jest/reporters@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"@jest/reporters@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"@jest/reporters@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-resolve-dependencies@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-resolve-dependencies@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-resolve-dependencies@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-resolve-dependencies@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"babel-jest@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-resolve-dependencies@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-resolve-dependencies@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-resolve-dependencies@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-resolve-dependencies@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-circus@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"@jest/core@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-18593780",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"0xsharz"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.1",
">=4.0.0 <4.3.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.15.1",
"4.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj",
"title": "GitHub Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-08T14:21:31.776417Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T14:21:31.776417Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `yaml.load` process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large `!!omap` sequence.\n## Remediation\nUpgrade `js-yaml` to version 3.15.1, 4.3.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-5p4m-2wfm-xmqj"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-08-08T14:21:31.424058Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-06T20:27:32Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-08T14:21:31.607599Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-08T14:21:31.776417Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-JSYAML-19496768",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
">=3.0.0 <3.15.2",
">=4.0.0 <4.3.2"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.15.2",
"4.3.2"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "js-yaml",
"references": [
{
"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodeca/js-yaml/pull/797",
"title": "GitHub PR"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
"title": "GitHub Release"
},
{
"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T14:03:42.572398Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T06:04:42.233201Z"
}
],
"description": "## Overview\n[js-yaml](https://www.npmjs.com/package/js-yaml) is a human-friendly data serialization language.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. \r\n\r\n**Note:** This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.\n## Remediation\nUpgrade `js-yaml` to version 3.15.2, 4.3.2 or higher.\n## References\n- [GitHub Advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480)\n- [GitHub Commit](https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b)\n- [GitHub PR](https://github.com/nodeca/js-yaml/pull/797)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/3.15.2)\n- [GitHub Release](https://github.com/nodeca/js-yaml/releases/tag/4.3.2)\n",
"epssDetails": {
"percentile": "0.31552",
"probability": "0.00385",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-84375"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-2883-xcg3-v3hh"
]
},
"packageName": "js-yaml",
"proprietary": false,
"creationTime": "2026-09-02T09:48:34.798885Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-02T00:39:25Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-02T09:48:35.070116Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-02T14:03:42.572398Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.0"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"@istanbuljs/load-nyc-config@1.1.0",
"js-yaml@3.15.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "js-yaml",
"version": "3.15.0"
},
{
"id": "SNYK-JS-NANOID-18506894",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"sajdakabir"
],
"semver": {
"vulnerable": [
"<3.3.16",
">=4.0.0 <5.1.16"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.3.16",
"5.1.16"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "nanoid",
"references": [
{
"url": "https://github.com/ai/nanoid/commit/6de05d794f62eeac3f527c74c34c6af0c1d32e49",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-19T01:29:26.647652Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-19T05:39:05.135161Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-08-22T15:45:25.400572Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-22T15:45:25.400572Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-19T01:29:26.647652Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-19T05:39:05.135161Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Infinite loop through the `customAlphabet` and `nanoid` functions in `nanoid/non-secure`. An attacker can hang the calling thread by supplying a negative size to either function, causing the loop counter to decrement from a negative value and never reach its termination condition. This affects applications that pass unvalidated attacker-controlled size values into the non-secure ID generator, where a single malicious request can spin the process indefinitely and stop the service from responding.\r\n\r\n**Notes**\r\n\r\n- The vulnerable code path is in the `nanoid/non-secure` entry point, so bundles or consumers that import the non-secure module directly are the ones exposed; the secure/default package path is a separate export.\r\n- The denial-of-service only shows up when callers pass a negative `size` into these APIs, which the advisory’s regression tests treat as returning an empty string rather than looping.\n## Remediation\nUpgrade `nanoid` to version 3.3.16, 5.1.16 or higher.\n## References\n- [GitHub Commit](https://github.com/ai/nanoid/commit/6de05d794f62eeac3f527c74c34c6af0c1d32e49)\n",
"epssDetails": {
"percentile": "0.26018",
"probability": "0.00330",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-67214"
],
"CWE": [
"CWE-835"
]
},
"packageName": "nanoid",
"proprietary": false,
"creationTime": "2026-08-02T08:46:50.155712Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-29T15:51:39Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-02T08:46:50.324306Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-22T15:45:25.400572Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"nanoid@5.1.7"
],
"upgradePath": [
false,
"nanoid@5.1.16"
],
"isUpgradable": true,
"isPatchable": false,
"name": "nanoid",
"version": "5.1.7"
},
{
"id": "SNYK-JS-NANOID-18748186",
"title": "Integer Overflow or Wraparound",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:L",
"credit": [
"alanzabihi"
],
"semver": {
"vulnerable": [
"<3.3.12",
">=4.0.0 <5.1.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.3.12",
"5.1.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.3,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "nanoid",
"references": [
{
"url": "https://github.com/ai/nanoid/commit/7087969281cab8ba8ae3babf1894e819068b3bb4",
"title": "GitHub Commit"
},
{
"url": "https://github.com/ai/nanoid/commit/821dfed7b5db7f88e92f56c60eef32c8135077c3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/ai/nanoid/commit/b0036ed60dc9facd7f1191a50dfb3076500202ac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/ai/nanoid/security/advisories/GHSA-xwg4-73v4-xw9w",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cvssV3BaseScore": 7.4,
"modificationTime": "2026-08-13T05:36:59.819726Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:L",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.3,
"cvssVersion": "4.0",
"modificationTime": "2026-08-13T08:50:54.590341Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:L",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T08:50:54.590341Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.4,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:36:59.819726Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Integer Overflow or Wraparound through the `fillPool` logic in `index.js` and `index.cjs`. An attacker can make subsequent ID generation deterministic by supplying an oversized `size` value to `nanoid(size)`, which is coerced into a negative 32-bit integer and corrupts the shared random pool state. After that call, all later IDs produced in the same process lose their randomness and uniqueness, breaking session tokens, CSRF tokens, and other identifiers until the process restarts.\n## Remediation\nUpgrade `nanoid` to version 3.3.12, 5.1.11 or higher.\n## References\n- [GitHub Commit](https://github.com/ai/nanoid/commit/7087969281cab8ba8ae3babf1894e819068b3bb4)\n- [GitHub Commit](https://github.com/ai/nanoid/commit/821dfed7b5db7f88e92f56c60eef32c8135077c3)\n- [GitHub Commit](https://github.com/ai/nanoid/commit/b0036ed60dc9facd7f1191a50dfb3076500202ac)\n- [Maintainer's Advisory](https://github.com/ai/nanoid/security/advisories/GHSA-xwg4-73v4-xw9w)\n",
"epssDetails": {
"percentile": "0.22045",
"probability": "0.00296",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73086"
],
"CWE": [
"CWE-190"
],
"GHSA": [
"GHSA-xwg4-73v4-xw9w"
]
},
"packageName": "nanoid",
"proprietary": false,
"creationTime": "2026-08-13T08:50:54.123936Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-12T17:41:43.179000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-13T08:50:54.371994Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-13T08:50:54.590341Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"nanoid@5.1.7"
],
"upgradePath": [
false,
"nanoid@5.1.11"
],
"isUpgradable": true,
"isPatchable": false,
"name": "nanoid",
"version": "5.1.7"
},
{
"id": "SNYK-JS-NANOID-18506894",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"sajdakabir"
],
"semver": {
"vulnerable": [
"<3.3.16",
">=4.0.0 <5.1.16"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.3.16",
"5.1.16"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "nanoid",
"references": [
{
"url": "https://github.com/ai/nanoid/commit/6de05d794f62eeac3f527c74c34c6af0c1d32e49",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-19T01:29:26.647652Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-19T05:39:05.135161Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-08-22T15:45:25.400572Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-22T15:45:25.400572Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-19T01:29:26.647652Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-19T05:39:05.135161Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Infinite loop through the `customAlphabet` and `nanoid` functions in `nanoid/non-secure`. An attacker can hang the calling thread by supplying a negative size to either function, causing the loop counter to decrement from a negative value and never reach its termination condition. This affects applications that pass unvalidated attacker-controlled size values into the non-secure ID generator, where a single malicious request can spin the process indefinitely and stop the service from responding.\r\n\r\n**Notes**\r\n\r\n- The vulnerable code path is in the `nanoid/non-secure` entry point, so bundles or consumers that import the non-secure module directly are the ones exposed; the secure/default package path is a separate export.\r\n- The denial-of-service only shows up when callers pass a negative `size` into these APIs, which the advisory’s regression tests treat as returning an empty string rather than looping.\n## Remediation\nUpgrade `nanoid` to version 3.3.16, 5.1.16 or higher.\n## References\n- [GitHub Commit](https://github.com/ai/nanoid/commit/6de05d794f62eeac3f527c74c34c6af0c1d32e49)\n",
"epssDetails": {
"percentile": "0.26018",
"probability": "0.00330",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-67214"
],
"CWE": [
"CWE-835"
]
},
"packageName": "nanoid",
"proprietary": false,
"creationTime": "2026-08-02T08:46:50.155712Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-29T15:51:39Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-02T08:46:50.324306Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-22T15:45:25.400572Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"nanoid-cjs@0.0.7",
"nanoid@5.1.7"
],
"upgradePath": [
false,
"nanoid-cjs@0.0.7",
"nanoid@5.1.16"
],
"isUpgradable": true,
"isPatchable": false,
"name": "nanoid",
"version": "5.1.7"
},
{
"id": "SNYK-JS-NANOID-18748186",
"title": "Integer Overflow or Wraparound",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:L",
"credit": [
"alanzabihi"
],
"semver": {
"vulnerable": [
"<3.3.12",
">=4.0.0 <5.1.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.3.12",
"5.1.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.3,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "nanoid",
"references": [
{
"url": "https://github.com/ai/nanoid/commit/7087969281cab8ba8ae3babf1894e819068b3bb4",
"title": "GitHub Commit"
},
{
"url": "https://github.com/ai/nanoid/commit/821dfed7b5db7f88e92f56c60eef32c8135077c3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/ai/nanoid/commit/b0036ed60dc9facd7f1191a50dfb3076500202ac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/ai/nanoid/security/advisories/GHSA-xwg4-73v4-xw9w",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cvssV3BaseScore": 7.4,
"modificationTime": "2026-08-13T05:36:59.819726Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:L",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.3,
"cvssVersion": "4.0",
"modificationTime": "2026-08-13T08:50:54.590341Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:L",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T08:50:54.590341Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.4,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:36:59.819726Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Integer Overflow or Wraparound through the `fillPool` logic in `index.js` and `index.cjs`. An attacker can make subsequent ID generation deterministic by supplying an oversized `size` value to `nanoid(size)`, which is coerced into a negative 32-bit integer and corrupts the shared random pool state. After that call, all later IDs produced in the same process lose their randomness and uniqueness, breaking session tokens, CSRF tokens, and other identifiers until the process restarts.\n## Remediation\nUpgrade `nanoid` to version 3.3.12, 5.1.11 or higher.\n## References\n- [GitHub Commit](https://github.com/ai/nanoid/commit/7087969281cab8ba8ae3babf1894e819068b3bb4)\n- [GitHub Commit](https://github.com/ai/nanoid/commit/821dfed7b5db7f88e92f56c60eef32c8135077c3)\n- [GitHub Commit](https://github.com/ai/nanoid/commit/b0036ed60dc9facd7f1191a50dfb3076500202ac)\n- [Maintainer's Advisory](https://github.com/ai/nanoid/security/advisories/GHSA-xwg4-73v4-xw9w)\n",
"epssDetails": {
"percentile": "0.22045",
"probability": "0.00296",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73086"
],
"CWE": [
"CWE-190"
],
"GHSA": [
"GHSA-xwg4-73v4-xw9w"
]
},
"packageName": "nanoid",
"proprietary": false,
"creationTime": "2026-08-13T08:50:54.123936Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-12T17:41:43.179000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-13T08:50:54.371994Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-13T08:50:54.590341Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"nanoid-cjs@0.0.7",
"nanoid@5.1.7"
],
"upgradePath": [
false,
"nanoid-cjs@0.0.7",
"nanoid@5.1.16"
],
"isUpgradable": true,
"isPatchable": false,
"name": "nanoid",
"version": "5.1.7"
},
{
"id": "SNYK-JS-SHARP-19653587",
"title": "Heap-based Buffer Overflow",
"CVSSv3": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<0.35.4"
]
},
"exploit": "Not Defined",
"fixedIn": [
"0.35.4"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.9,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "sharp",
"references": [
{
"url": "https://github.com/lovell/sharp/releases/tag/v0.35.4",
"title": "GitHub Release"
},
{
"url": "https://github.com/lovell/sharp/security/advisories/GHSA-rgj7-g3m4-5g8c",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.9,
"cvssVersion": "4.0",
"modificationTime": "2026-09-09T13:56:44.690133Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-09-09T13:56:44.690133Z"
}
],
"description": "## Overview\n[sharp](https://www.npmjs.org/package/sharp) is a High performance Node.js image processing, the fastest module to resize JPEG, PNG, WebP, GIF, AVIF and TIFF images\n\nAffected versions of this package are vulnerable to Heap-based Buffer Overflow in the `VipsForeignLoadHeif` process. An attacker can execute arbitrary code by providing specially crafted AVIF images as input. \n\n## Workaround \nThis vulnerability can be mitigated by blocking the decoding of AVIF images using the configuration sharp.block({ operation: [\"VipsForeignLoadHeif\"] }); and by ensuring the Node.js executable is compiled as a Position Independent Executable (PIE).\n## Remediation\nUpgrade `sharp` to version 0.35.4 or higher.\n## References\n- [GitHub Release](https://github.com/lovell/sharp/releases/tag/v0.35.4)\n- [Maintainer's Advisory](https://github.com/lovell/sharp/security/advisories/GHSA-rgj7-g3m4-5g8c)\n",
"epssDetails": null,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-122"
],
"GHSA": [
"GHSA-rgj7-g3m4-5g8c"
]
},
"packageName": "sharp",
"proprietary": false,
"creationTime": "2026-09-09T13:56:44.366968Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-08T21:25:11Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-09T13:56:44.573106Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-09T13:56:44.690133Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"services@*",
"sharp@0.35.3"
],
"upgradePath": [
false,
"sharp@0.35.4"
],
"isUpgradable": true,
"isPatchable": false,
"name": "sharp",
"version": "0.35.3"
}
],
"ok": false,
"dependencyCount": 868,
"org": "sean.graham",
"policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n",
"isPrivate": true,
"licensesPolicy": {
"severities": {},
"orgLicenseRules": {
"AGPL-1.0": {
"licenseType": "AGPL-1.0",
"severity": "high",
"instructions": ""
},
"AGPL-3.0": {
"licenseType": "AGPL-3.0",
"severity": "high",
"instructions": ""
},
"Artistic-1.0": {
"licenseType": "Artistic-1.0",
"severity": "medium",
"instructions": ""
},
"Artistic-2.0": {
"licenseType": "Artistic-2.0",
"severity": "medium",
"instructions": ""
},
"CDDL-1.0": {
"licenseType": "CDDL-1.0",
"severity": "medium",
"instructions": ""
},
"CPOL-1.02": {
"licenseType": "CPOL-1.02",
"severity": "high",
"instructions": ""
},
"EPL-1.0": {
"licenseType": "EPL-1.0",
"severity": "medium",
"instructions": ""
},
"GPL-2.0": {
"licenseType": "GPL-2.0",
"severity": "high",
"instructions": ""
},
"GPL-3.0": {
"licenseType": "GPL-3.0",
"severity": "high",
"instructions": ""
},
"LGPL-2.0": {
"licenseType": "LGPL-2.0",
"severity": "medium",
"instructions": ""
},
"LGPL-2.1": {
"licenseType": "LGPL-2.1",
"severity": "medium",
"instructions": ""
},
"LGPL-3.0": {
"licenseType": "LGPL-3.0",
"severity": "medium",
"instructions": ""
},
"MPL-1.1": {
"licenseType": "MPL-1.1",
"severity": "medium",
"instructions": ""
},
"MPL-2.0": {
"licenseType": "MPL-2.0",
"severity": "medium",
"instructions": ""
},
"MS-RL": {
"licenseType": "MS-RL",
"severity": "medium",
"instructions": ""
},
"SimPL-2.0": {
"licenseType": "SimPL-2.0",
"severity": "high",
"instructions": ""
}
}
},
"packageManager": "npm",
"ignoreSettings": {
"adminOnly": false,
"reasonRequired": false,
"disregardFilesystemIgnores": false,
"autoApproveIgnores": false,
"approvalWorkflowEnabled": false
},
"docker": {},
"summary": "753 high or critical severity vulnerable dependency paths",
"severityThreshold": "high",
"remediation": {
"unresolved": [
{
"id": "SNYK-JS-BROWSERSLIST-18854715",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-10T14:05:31.427772Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:33:10.546368Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `normalizeStats()` function in `node.js`. An attacker can crash the process or alter an object’s prototype by supplying a poisoned `browserslist-stats.json` file or untrusted `stats` data with inherited object-key names such as `__proto__` or `toString`. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a `TypeError` on lookup or invoke the `__proto__` setter during assignment, breaking any tool that calls `browserslist()` and causing a denial of service.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g)\n",
"epssDetails": {
"percentile": "0.37004",
"probability": "0.00439",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73088"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-73wf-gq98-2v4g"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T08:17:01.297995Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T19:00:31.005000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T08:17:01.584069Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-10T14:05:31.427772Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "browserslist",
"version": "4.28.2",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-BROWSERSLIST-18856271",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"iaohkut-from-NightWolf-Team"
],
"semver": {
"vulnerable": [
"<4.28.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"4.28.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "browserslist",
"references": [
{
"url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
"title": "GitHub Commit"
},
{
"url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-16T09:57:28.551627Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-13T05:32:51.594140Z"
}
],
"description": "## Overview\n[browserslist](https://www.npmjs.org/package/browserslist) is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory `cache` and `parseCache` in `index.js`. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique `browserslist()` result and parsed query AST to be retained indefinitely.\n## Remediation\nUpgrade `browserslist` to version 4.28.7 or higher.\n## References\n- [GitHub Commit](https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405)\n- [Maintainer's Advisory](https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx)\n",
"epssDetails": {
"percentile": "0.28895",
"probability": "0.00360",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-73089"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-c83g-rgw3-j3cx"
]
},
"packageName": "browserslist",
"proprietary": false,
"creationTime": "2026-08-16T09:57:27.822197Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-13T15:59:52.824000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-16T09:57:28.056326Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-16T09:57:28.551627Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"services@*",
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.0",
"@babel/helper-compilation-targets@7.28.6",
"browserslist@4.28.2"
],
"upgradePath": [
false,
"jest@29.7.0",
"jest-cli@29.7.0",
"create-jest@29.7.0",
"jest-config@29.7.0",
"jest-runner@29.7.0",
"jest-runtime@29.7.0",
"@jest/globals@29.7.0",
"@jest/expect@29.7.0",
"jest-snapshot@29.7.0",
"@jest/transform@29.7.0",
"babel-plugin-istanbul@6.1.1",
"istanbul-lib-instrument@5.2.1",
"@babel/core@7.29.7",
"@babel/helper-compilation-targets@7.29.7",
"browserslist@4.28.9"
],
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "browserslist",
"version": "4.28.2",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-EXTRACTZIP-17660777",
"title": "Directory Traversal",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"credit": [
"Ziad Salah"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.6,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "extract-zip",
"references": [
{
"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-177-01.json",
"title": "Advisory"
},
{
"url": "https://github.com/ziad626/extract-zip-security-research/security/advisories/GHSA-x7jf-2287-qcpf",
"title": "GitHub Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"cvssV3BaseScore": 8.1,
"modificationTime": "2026-06-30T07:17:19.904850Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.6,
"cvssVersion": "4.0",
"modificationTime": "2026-07-24T14:06:06.638835Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-07-24T14:06:06.638835Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-06-30T07:17:19.904850Z"
}
],
"description": "## Overview\n[extract-zip](https://www.npmjs.org/package/extract-zip) is an unzip a zip file into a directory using 100% javascript\n\nAffected versions of this package are vulnerable to Directory Traversal via the extraction process. An attacker can access or modify arbitrary files by crafting a malicious zip archive containing symlinks that point outside the intended extraction directory.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nThere is no fixed version for `extract-zip`.\n## References\n- [Advisory](https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-177-01.json)\n- [GitHub Advisory](https://github.com/ziad626/extract-zip-security-research/security/advisories/GHSA-x7jf-2287-qcpf)\n",
"epssDetails": {
"percentile": "0.31654",
"probability": "0.00391",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-56876"
],
"CWE": [
"CWE-22"
],
"GHSA": [
"GHSA-x7jf-2287-qcpf"
]
},
"packageName": "extract-zip",
"proprietary": false,
"creationTime": "2026-06-28T07:51:29.464799Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-26T18:15:06Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-28T07:51:29.629427Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-07-24T14:06:06.638835Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"services@*",
"@types/extract-zip@2.0.3",
"extract-zip@2.0.1"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "extract-zip",
"version": "2.0.1",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-EXTRACTZIP-19653641",
"title": "Directory Traversal",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
"credit": [],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 7.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "extract-zip",
"references": [
{
"url": "https://github.com/max-mapper/extract-zip/commit/f27984342f2e12acac1615090592460cd456e650",
"title": "GitHub Commit"
},
{
"url": "https://github.com/max-mapper/extract-zip/pull/160",
"title": "GitHub PR"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
"cvssV3BaseScore": 8.1,
"modificationTime": "2026-08-28T05:32:37.302301Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.2,
"cvssVersion": "4.0",
"modificationTime": "2026-09-09T14:54:23.322433Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-09-09T14:54:23.322433Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-08-28T05:32:37.302301Z"
}
],
"description": "## Overview\n[extract-zip](https://www.npmjs.org/package/extract-zip) is an unzip a zip file into a directory using 100% javascript\n\nAffected versions of this package are vulnerable to Directory Traversal through the archive extraction logic in `index.js`. An attacker can write a file outside the destination directory by supplying an archive with two entries that reuse the same path: a symlink pointing outside the extraction root, followed by a regular file for that same name. During extraction, the code only checked the parent directory of each entry and then wrote the file through the existing final path component, so the second entry followed the planted symlink and overwrote the symlink target. This can corrupt or replace files writable by the process running `extract-zip`.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nA fix was pushed into the `master` branch but not yet published.\n## References\n- [GitHub Commit](https://github.com/max-mapper/extract-zip/commit/f27984342f2e12acac1615090592460cd456e650)\n- [GitHub PR](https://github.com/max-mapper/extract-zip/pull/160)\n",
"epssDetails": {
"percentile": "0.20481",
"probability": "0.00280",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-19693"
],
"CWE": [
"CWE-22"
],
"GHSA": [
"GHSA-7pqw-9j4j-h8q3"
]
},
"packageName": "extract-zip",
"proprietary": false,
"creationTime": "2026-09-09T14:54:22.763062Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-17T15:30:40Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-09T14:54:23.005562Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-09T14:54:23.322433Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"services@*",
"@types/extract-zip@2.0.3",
"extract-zip@2.0.1"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "extract-zip",
"version": "2.0.1",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-IMAGESIZE-17295814",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Proof of Concept",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "image-size",
"references": [
{
"url": "https://web.archive.org/web/20260224152152/https://github.com/image-size/image-size/pull/439",
"title": "GitHub PR"
},
{
"url": "https://joshua.hu/image-size-infinite-loop-dos-vulnerabilities",
"title": "Vulnerability Report"
},
{
"url": "https://codeberg.org/image-size/image-size/src/branch/main/lib/types/jxl.ts%23L21",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-06-16T14:58:03.788412Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-06-11T01:23:00.766258Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-05T02:01:24.424560Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T02:01:24.424560Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-06-16T14:58:03.788412Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-06-11T01:23:00.766258Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Infinite loop in the `extractPartialStreams()` and corresponding extraction functions for HEIF, JP2, and JXL. An attacker supplying an image whose requested box declares a size of zero can hang the parser indefinitely.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2025-71319](https://security.snyk.io/vuln/SNYK-JS-IMAGESIZE-9634164).\n## Remediation\nThere is no fixed version for `image-size`.\n## References\n- [GitHub PR](https://web.archive.org/web/20260224152152/https://github.com/image-size/image-size/pull/439)\n- [Vulnerability Report](https://joshua.hu/image-size-infinite-loop-dos-vulnerabilities)\n- [Vulnerable Code](https://codeberg.org/image-size/image-size/src/branch/main/lib/types/jxl.ts#L21)\n",
"epssDetails": {
"percentile": "0.34280",
"probability": "0.00430",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2025-71329"
],
"CWE": [
"CWE-835"
]
},
"packageName": "image-size",
"proprietary": false,
"creationTime": "2026-06-11T10:39:40.827383Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-10T14:38:17Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-11T10:39:40.987645Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-05T02:01:24.424560Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"services@*",
"image-size@2.0.2"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "image-size",
"version": "2.0.2",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-IMAGESIZE-17295816",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Proof of Concept",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "image-size",
"references": [
{
"url": "https://web.archive.org/web/20260224152152/https://github.com/image-size/image-size/pull/439",
"title": "GitHub PR"
},
{
"url": "https://joshua.hu/image-size-infinite-loop-dos-vulnerabilities",
"title": "Vulnerability Report"
},
{
"url": "https://codeberg.org/image-size/image-size/src/branch/main/lib/types/icns.ts%23L94",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-06-16T14:56:48.045341Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-06-11T01:22:58.500245Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-11T02:01:08.848643Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-11T02:01:08.848643Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-06-16T14:56:48.045341Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-06-11T01:22:58.500245Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Infinite loop in `icns.js`. An ICNS file with an icon entry whose declared length is zero can hang the parser indefinitely.\n## Remediation\nThere is no fixed version for `image-size`.\n## References\n- [GitHub PR](https://web.archive.org/web/20260224152152/https://github.com/image-size/image-size/pull/439)\n- [Vulnerability Report](https://joshua.hu/image-size-infinite-loop-dos-vulnerabilities)\n- [Vulnerable Code](https://codeberg.org/image-size/image-size/src/branch/main/lib/types/icns.ts#L94)\n",
"epssDetails": {
"percentile": "0.34280",
"probability": "0.00430",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2025-71330"
],
"CWE": [
"CWE-835"
]
},
"packageName": "image-size",
"proprietary": false,
"creationTime": "2026-06-11T10:43:12.039483Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-10T14:38:09Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-11T10:43:12.497488Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-11T02:01:08.848643Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"services@*",
"image-size@2.0.2"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "image-size",
"version": "2.0.2",
"severityWithCritical": "high"
}
],
"upgrade": {
"eslint@8.57.1": {
"upgradeTo": "eslint@10.0.0",
"upgrades": [
"js-yaml@4.3.0",
"js-yaml@4.3.0"
],
"vulns": [
"SNYK-JS-JSYAML-18593780",
"SNYK-JS-JSYAML-19496768"
]
},
"nanoid@5.1.7": {
"upgradeTo": "nanoid@5.1.16",
"upgrades": [
"nanoid@5.1.7",
"nanoid@5.1.7"
],
"vulns": [
"SNYK-JS-NANOID-18506894",
"SNYK-JS-NANOID-18748186"
]
},
"sharp@0.35.3": {
"upgradeTo": "sharp@0.35.4",
"upgrades": [
"sharp@0.35.3"
],
"vulns": [
"SNYK-JS-SHARP-19653587"
]
}
},
"patch": {},
"ignore": {},
"pin": {}
},
"filesystemPolicy": false,
"filtered": {
"ignore": [],
"patch": []
},
"uniqueCount": 11,
"targetFile": "/opt/scopear/app/services/node_modules",
"projectName": "services",
"displayTargetFile": "/opt/scopear/app/services/node_modules",
"hasUnknownVersions": false,
"path": "docker.io/scopear/docker-wlc2-api:2.50.6_def3651.4115"
},
{
"vulnerabilities": [
{
"id": "SNYK-JS-ADMZIP-19276676",
"title": "Symlink Attack",
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
"credit": [
"Muhammad Sobirov"
],
"semver": {
"vulnerable": [
">=0.5.9"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "adm-zip",
"references": [
{
"url": "https://github.com/cthackers/adm-zip/blob/v0.6.0/util/utils.js",
"title": "github.com"
},
{
"url": "https://github.com/cthackers/adm-zip/issues/574",
"title": "GitHub Issue"
},
{
"url": "https://github.com/cthackers/adm-zip/blob/2b4d84087d45344643e0183756e19191d52815cc/util/utils.js%23L65-L88",
"title": "Vulnerable Code utils.js:65-88"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-08-25T01:29:56.558038Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-08-28T14:00:01.645132Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-08-28T14:00:02.074325Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-28T14:00:02.074325Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
"assigner": "NVD",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-25T01:29:56.558038Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-28T14:00:01.645132Z"
}
],
"description": "## Overview\n[adm-zip](https://www.npmjs.com/package/adm-zip) is a JavaScript implementation for zip data compression for NodeJS.\n\nAffected versions of this package are vulnerable to Symlink Attack through the `extractAllTo`, `extractAllToAsync`, and `extractEntryTo` code paths in `util/utils.js`. An attacker can write attacker-controlled contents outside the extraction root by placing a symbolic link inside the destination directory and then supplying an archive entry that is extracted with overwrite enabled. This can replace any file the extracting process is allowed to write, breaking the integrity of files in shared, reused, or predictable extraction locations such as temporary directories or CI workspaces.\n## Remediation\nThere is no fixed version for `adm-zip`.\n## References\n- [github.com](https://github.com/cthackers/adm-zip/blob/v0.6.0/util/utils.js)\n- [GitHub Issue](https://github.com/cthackers/adm-zip/issues/574)\n- [Vulnerable Code utils.js:65-88](https://github.com/cthackers/adm-zip/blob/2b4d84087d45344643e0183756e19191d52815cc/util/utils.js#L65-L88)\n",
"epssDetails": {
"percentile": "0.02945",
"probability": "0.00131",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-76845"
],
"CWE": [
"CWE-59"
]
},
"packageName": "adm-zip",
"proprietary": false,
"creationTime": "2026-08-27T08:59:37.276884Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-24T18:48:31.997000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-27T08:59:37.456389Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-28T14:00:02.074325Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"worklink-create-api@1.0.0",
"adm-zip@0.6.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "adm-zip",
"version": "0.6.0"
}
],
"ok": false,
"dependencyCount": 154,
"org": "sean.graham",
"policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n",
"isPrivate": true,
"licensesPolicy": {
"severities": {},
"orgLicenseRules": {
"AGPL-1.0": {
"licenseType": "AGPL-1.0",
"severity": "high",
"instructions": ""
},
"AGPL-3.0": {
"licenseType": "AGPL-3.0",
"severity": "high",
"instructions": ""
},
"Artistic-1.0": {
"licenseType": "Artistic-1.0",
"severity": "medium",
"instructions": ""
},
"Artistic-2.0": {
"licenseType": "Artistic-2.0",
"severity": "medium",
"instructions": ""
},
"CDDL-1.0": {
"licenseType": "CDDL-1.0",
"severity": "medium",
"instructions": ""
},
"CPOL-1.02": {
"licenseType": "CPOL-1.02",
"severity": "high",
"instructions": ""
},
"EPL-1.0": {
"licenseType": "EPL-1.0",
"severity": "medium",
"instructions": ""
},
"GPL-2.0": {
"licenseType": "GPL-2.0",
"severity": "high",
"instructions": ""
},
"GPL-3.0": {
"licenseType": "GPL-3.0",
"severity": "high",
"instructions": ""
},
"LGPL-2.0": {
"licenseType": "LGPL-2.0",
"severity": "medium",
"instructions": ""
},
"LGPL-2.1": {
"licenseType": "LGPL-2.1",
"severity": "medium",
"instructions": ""
},
"LGPL-3.0": {
"licenseType": "LGPL-3.0",
"severity": "medium",
"instructions": ""
},
"MPL-1.1": {
"licenseType": "MPL-1.1",
"severity": "medium",
"instructions": ""
},
"MPL-2.0": {
"licenseType": "MPL-2.0",
"severity": "medium",
"instructions": ""
},
"MS-RL": {
"licenseType": "MS-RL",
"severity": "medium",
"instructions": ""
},
"SimPL-2.0": {
"licenseType": "SimPL-2.0",
"severity": "high",
"instructions": ""
}
}
},
"packageManager": "npm",
"ignoreSettings": {
"adminOnly": false,
"reasonRequired": false,
"disregardFilesystemIgnores": false,
"autoApproveIgnores": false,
"approvalWorkflowEnabled": false
},
"docker": {},
"summary": "1 high or critical severity vulnerable dependency path",
"severityThreshold": "high",
"remediation": {
"unresolved": [
{
"id": "SNYK-JS-ADMZIP-19276676",
"title": "Symlink Attack",
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
"credit": [
"Muhammad Sobirov"
],
"semver": {
"vulnerable": [
">=0.5.9"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "adm-zip",
"references": [
{
"url": "https://github.com/cthackers/adm-zip/blob/v0.6.0/util/utils.js",
"title": "github.com"
},
{
"url": "https://github.com/cthackers/adm-zip/issues/574",
"title": "GitHub Issue"
},
{
"url": "https://github.com/cthackers/adm-zip/blob/2b4d84087d45344643e0183756e19191d52815cc/util/utils.js%23L65-L88",
"title": "Vulnerable Code utils.js:65-88"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-08-25T01:29:56.558038Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-08-28T14:00:01.645132Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-08-28T14:00:02.074325Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-28T14:00:02.074325Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
"assigner": "NVD",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-25T01:29:56.558038Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-28T14:00:01.645132Z"
}
],
"description": "## Overview\n[adm-zip](https://www.npmjs.com/package/adm-zip) is a JavaScript implementation for zip data compression for NodeJS.\n\nAffected versions of this package are vulnerable to Symlink Attack through the `extractAllTo`, `extractAllToAsync`, and `extractEntryTo` code paths in `util/utils.js`. An attacker can write attacker-controlled contents outside the extraction root by placing a symbolic link inside the destination directory and then supplying an archive entry that is extracted with overwrite enabled. This can replace any file the extracting process is allowed to write, breaking the integrity of files in shared, reused, or predictable extraction locations such as temporary directories or CI workspaces.\n## Remediation\nThere is no fixed version for `adm-zip`.\n## References\n- [github.com](https://github.com/cthackers/adm-zip/blob/v0.6.0/util/utils.js)\n- [GitHub Issue](https://github.com/cthackers/adm-zip/issues/574)\n- [Vulnerable Code utils.js:65-88](https://github.com/cthackers/adm-zip/blob/2b4d84087d45344643e0183756e19191d52815cc/util/utils.js#L65-L88)\n",
"epssDetails": {
"percentile": "0.02945",
"probability": "0.00131",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-76845"
],
"CWE": [
"CWE-59"
]
},
"packageName": "adm-zip",
"proprietary": false,
"creationTime": "2026-08-27T08:59:37.276884Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-24T18:48:31.997000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-27T08:59:37.456389Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-28T14:00:02.074325Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"worklink-create-api@1.0.0",
"adm-zip@0.6.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "adm-zip",
"version": "0.6.0",
"severityWithCritical": "high"
}
],
"upgrade": {},
"patch": {},
"ignore": {},
"pin": {}
},
"filesystemPolicy": false,
"filtered": {
"ignore": [],
"patch": []
},
"uniqueCount": 1,
"targetFile": "/opt/scopear/app/services/api/package.json",
"projectName": "worklink-create-api",
"displayTargetFile": "/opt/scopear/app/services/api/package.json",
"hasUnknownVersions": false,
"path": "docker.io/scopear/docker-wlc2-api:2.50.6_def3651.4115"
},
{
"vulnerabilities": [],
"ok": true,
"dependencyCount": 1,
"org": "sean.graham",
"policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n",
"isPrivate": true,
"licensesPolicy": {
"severities": {},
"orgLicenseRules": {
"AGPL-1.0": {
"licenseType": "AGPL-1.0",
"severity": "high",
"instructions": ""
},
"AGPL-3.0": {
"licenseType": "AGPL-3.0",
"severity": "high",
"instructions": ""
},
"Artistic-1.0": {
"licenseType": "Artistic-1.0",
"severity": "medium",
"instructions": ""
},
"Artistic-2.0": {
"licenseType": "Artistic-2.0",
"severity": "medium",
"instructions": ""
},
"CDDL-1.0": {
"licenseType": "CDDL-1.0",
"severity": "medium",
"instructions": ""
},
"CPOL-1.02": {
"licenseType": "CPOL-1.02",
"severity": "high",
"instructions": ""
},
"EPL-1.0": {
"licenseType": "EPL-1.0",
"severity": "medium",
"instructions": ""
},
"GPL-2.0": {
"licenseType": "GPL-2.0",
"severity": "high",
"instructions": ""
},
"GPL-3.0": {
"licenseType": "GPL-3.0",
"severity": "high",
"instructions": ""
},
"LGPL-2.0": {
"licenseType": "LGPL-2.0",
"severity": "medium",
"instructions": ""
},
"LGPL-2.1": {
"licenseType": "LGPL-2.1",
"severity": "medium",
"instructions": ""
},
"LGPL-3.0": {
"licenseType": "LGPL-3.0",
"severity": "medium",
"instructions": ""
},
"MPL-1.1": {
"licenseType": "MPL-1.1",
"severity": "medium",
"instructions": ""
},
"MPL-2.0": {
"licenseType": "MPL-2.0",
"severity": "medium",
"instructions": ""
},
"MS-RL": {
"licenseType": "MS-RL",
"severity": "medium",
"instructions": ""
},
"SimPL-2.0": {
"licenseType": "SimPL-2.0",
"severity": "high",
"instructions": ""
}
}
},
"packageManager": "npm",
"ignoreSettings": {
"adminOnly": false,
"reasonRequired": false,
"disregardFilesystemIgnores": false,
"autoApproveIgnores": false,
"approvalWorkflowEnabled": false
},
"docker": {},
"summary": "No high or critical severity vulnerabilities",
"severityThreshold": "high",
"filesystemPolicy": false,
"uniqueCount": 0,
"targetFile": "/opt/scopear/.npm-global/lib/node_modules",
"projectName": "lib",
"displayTargetFile": "/opt/scopear/.npm-global/lib/node_modules",
"hasUnknownVersions": false,
"path": "docker.io/scopear/docker-wlc2-api:2.50.6_def3651.4115"
}
]
}